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JOHN GREENEWALD 
THE BLACK VAULT 


RE: ICE FOIA Case Number 2015-ICFO-82330 

Mr. Greene wald: 

This letter is the final response to your Freedom of Information Act (FOIA) request to U.S. 
Immigration and Customs Enforcement (ICE) dated May 25, 2015. You requested records 
pertaining to Operation Flicker (see request for details). 

ICE has considered your request under the FOIA, 5 U.S.C. § 552. 

A search of the ICE Office of Homeland Security Investigations (HSI) produced 929 pages 
responsive to your request. After a review of those documents, ICE has determined that portions 
will be withheld pursuant to Exemptions of the FOIA as described below: 

FOIA Exemption (b)(3): 18 U.S.C. § 3509(d) protects certain records containing identifying 
information pertaining to children involved in criminal proceedings. 

FOIA Exemption 5 protects from disclosure those inter- or intra-agency documents that are 
normally privileged in the civil discovery context. The three most frequently invoked privileges 
are the deliberative process privilege, the attorney work-product privilege, and the attorney-client 
privilege. After carefully reviewing the responsive documents, I have determined that portions 
of the responsive documents qualify for protection under the deliberative process privilege, the 
attorney-client privilege, and the attorney work-product privilege. The deliberative process 
privilege protects the integrity of the deliberative or decision-making processes within the 
agency by exempting from mandatory disclosure opinions, conclusions, and recommendations 
included within inter-agency or intra-agency memoranda or letters. The release of this internal 
information would discourage the expression of candid opinions and inhibit the free and frank 
exchange of information among agency personnel. The attorney work-product privilege protects 
documents and other memoranda prepared by an attorney in contemplation of litigation. The 
attorney-client privilege protects confidential communications between an attorney and his client 
relating to a legal matter for which the client has sought professional advice. It applies to facts 
divulged by a client to his attorney, and encompasses any opinions given by an attorney to his 
client based upon, and thus reflecting, those facts, as well as communications between attorneys 
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that reflect client-supplied information. The attorney-client privilege is not limited to the context 
of litigation. 

FOIA Exemption 6 exempts from disclosure personnel or medical files and similar files the 
release of which would cause a clearly unwarranted invasion of personal privacy. This requires a 
balancing of the public’s right to disclosure against the individual’s right to privacy. The privacy 
interests of the individuals in the records you have requested outweigh any minimal public 
interest in disclosure of the information. Any private interest you may have in that information 
does not factor into the aforementioned balancing test. 

FOIA Exemption 7(C) protects records or information compiled for law enforcement purposes 
that could reasonably be expected to constitute an unwarranted invasion of personal privacy. 

This exemption takes particular note of the strong interests of individuals, whether they are 
suspects, witnesses, or investigators, in not being unwarrantably associated with alleged criminal 
activity. That interest extends to persons who are not only the subjects of the investigation, but 
those who may have their privacy invaded by having their identities and information about them 
revealed in connection with an investigation. Based upon the traditional recognition of strong 
privacy interest in law enforcement records, categorical withholding of information that 
identifies third parties in law enforcement records is ordinarily appropriate. As such, I have 
determined that the privacy interest in the identities of individuals in the records you have 
requested clearly outweigh any minimal public interest in disclosure of the information. Please 
note that any private interest you may have in that information does not factor into this 
determination. 

FOIA Exemption 7(E) protects records compiled for law enforcement purposes, the release of 
which would disclose techniques and/or procedures for law enforcement investigations or 
prosecutions, or would disclose guidelines for law enforcement investigations or prosecutions if 
such disclosure could reasonably be expected to risk circumvention of the law. I have 
determined that disclosure of certain law enforcement sensitive information contained within the 
responsive records could reasonably be expected to risk circumvention of the law. Additionally, 
the techniques and procedures at issue are not well known to the public. 

You have the right to appeal ICE’s determination and should you wish to do so, please send your 
appeal following the procedures outlined in the DHS regulations at 6 Code of Federal 
Regulations § 5.9 and a copy of this letter to: 

U.S. Immigration and Customs Enforcement 
Office of Principal Legal Advisor 
U.S. Department of Homeland Security 
Freedom of Information Act Office 
500 12th Street, S.W., Stop 5900 
Washington, D.C. 20536-5900 

Your appeal must be received within 60 days of the date of this letter. Your envelope and letter 
should be marked “FOIA Appeal.” Copies of the FOIA and DHS regulations are available at 
www.dhs.gov/foia . 
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Provisions of the FOIA and Privacy Act allow us to recover part of the cost of complying with 
your request. In this instance, because the cost is below the $14 minimum, there is no charge. 1 

If you need to contact the FOIA office about this matter, please call (866) 633-1182 and refer to 
FOIA case number 2015-ICFO-82330. 


Sincerely, 

Catrina M. Pavlik- Keenan 
FOIA Officer 


Enclosure: 929 pages 



In April 2006, the Immigration and Customs Enforcement (ICE), Cyber 
Crimes Center (C3) , Child Exploitation Section (CES) initiated an 
investigation into a criminal organization operating a commercial child 
exploitation Images website known as " 1(b)(3): is u.s.c. s 3509 (d) ci . " The 
investigation has revealed that the same organization is operating 
numerous commercial child exploitation image websites. In. addition, 
the organization utilizes various PayPal accounts to process the 
payments for access to the member restricted websites. The 
investigation is being worked jointly with ICK/C3/CKS, 

ICE ./RAC /Birmingham, the U.S. Postal Inspection Service, the II. S. 
Department of Justice (DOJ) , Child Exploitation and Obscenity Section 
(CEOS), and t.he United States Attorney's Office (1JSA0) for the Northern 
District of Aiabama. ICE has designated this operation as PROJECT 
FLICKER. 


(b)(7)(E) | 

(b)(7)(E) | . The 

information developed during the course of the investigation has 
identified that the organization uses various PayPal accounts to 
facilitate the customer payments; uses specific subject identifiers are 
used with the PayPal accounts to identify the various member restricted 
websites; and uses specific administrative e-mail accounts are used to 
distribute access t.o the member restricted websites. The following 
member restricted websites have beet) identified (with the associated 
subject identifiers): 

Ken'bcr Renlr 1 Clod 1 > <:• 1 ■ '■ 3 L ■ den 1. I Tier 


(b)(3): 1 8 U.S.C. § 3509(d) Child victims' and child witnesses rights,(b)(3):18 U.S C. § 3509(d) (Federal Victims' Protection and 
Rights Act) 


The following administrative c-rnail addresses have been associated with 
the distribution of the location and login information for the member 
restricted websites: 


(b)(6). (b)(7)(C) |@gmail . com 

(b)(6), (b)(7)(C) | @yahoo . com 

,u «7A un " |Q b i 1 1 inq - support .biz 
l gumail.com 


(b)(7)(E) | 

(b)(7)(E) | . The FCACP is a 

partnership sponsored by NOll-.C that brings together financial industry 
members, NCMEC, and federal law enforcement agencies with the goal of 
eradicating commercial child exploitation.! (b)(7)(E) "| 

I (bX7XE) | - 
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The investigation has identified a group of individuals within the 'J.S. 
that own and control numerous PayPal accounts. The PayPal accounts are 
being utilized to facilitate the customer payments for the above listed 
ch i d exo'. o : tat : on member websites. As discussed above, the owners of 
the PayPai accounts use specific subject identifiers to indicate which 
member restricted website the customer has purchased access to. 
ICE/C3./CES has conducted purchases into each of the listed member 
restricted websites; and in many instances more than one undercover 
transaction was conducted. The following PayPal accounts have been 
identified (the identity is both the business name provided to PayPal 
and the primary e-mail addresses associated with the account) : 


Business Name: 


(b)(3): 18 U.S.C. § 3509(d) Child 
victims 1 and child witnesses rights 
(b)(3): 1 8 U.S.C. § 3509(d) (Federal 
Victims' Protection and Rights Act) 


Primary E-Kail Address: 
juno.com 
|@ i uno . com 
|0 juno.com 
Qgmail . com 
@gmail. com 

S otmail.com 
ahoo.com 
juno.com 


(b)(6) (b)(7)(C)|0 
(b)(6), (b)(7)(C) 
(b)(6) (b)(7)(C) 
(b)(6), (b)(7)(C) 
b)(6),(b)(7)(C 
(b)(6), (b)(7)(C) 
(b)(6), (b)(7)(C) 
(b)(6), (b)(7)(C) 


(b)(7)(E) 


I (b)(7)(E) | . There are two categories of subscriber leads 

that will be detailed: those subscribers with both PayPa'. transactional 
records and member restricted website access logs (which identify 
specific files o:i the member restricted website the customer accessed) 
and those subscribers with only PayPal transactional records. 


I 1,11 7llEl ~ | l 

The Project flicker investigation was initiated in April 2006 based on 
information received from the NCMEC Cybertip Line. NCMEC provided that 
the website located at I(b)(3|i8us.c 5 3509(d) child victims andTl was a commercial 
website offering the sale of child exploitation images. The website at 
t he listed Uni form Resource Language (URL) , or name, was known as 
"Lb^isusc^j^sso^. " The website contained images depicting 


(b)(3): 18 U.S.C. § 3509(d) Child victims' and child witnesses rights (b)(3): 18 U.S.C. § 3509(d) (Federal Victims' Protection and Rights 
Act), (b)(7)(E) 


ICE/C3/CES received access to a member restricted child exploitation 
website known as " I I " from e-mail | (b)(6), (b)(7)(C) | @gmail.com. 
The member restricted website was located at URL 

A parLia: caplure of the website was 
made and the 1,000 downloaded images were forwarded to NCMEC for 
identification against their Child Victim Identification Program 
(CVIP) , which revealed that of this sampling, 171 images were of child 
victims previously identified by law enforcement investigations 


Page 2 of 929 



via a pair, e-mail regarding 
ebsite, also known as 
location or 


(b)(3): 18 U.S.C. § 3509(d) Child victims' a 


The wens it e was hosted at. 'Apollo Hosting" m Texas. 

in October 2006, :CK/C3/CKS received in forma lion via spam e-ir.a i 
regarding four additional commercial child exploitation im age website 
These advert ising websites were known as "\ , L " 

L " and P™ s™ 
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c member restricted websites known 
'3>: 1 8 uscT * were hosted at "Lunarpage 
stricted websites known as v 
sted aL ”1, aye red 'technologies" in 



The following breakdown displays the number of test transa 
conducted through each of the specified subject identifier 









content of the member restricted website, 

l. r U '" U . - I . hosted at Genesis2 Networks. Within the 

data obtained pursuant to the search warrant were two files relevant to 
Lhe subscriber ‘.eads. The rirsl file was titled " | (b)(7)(E) ~\ " ar.d 

the second was " I (b)(7)(E) ~l " ■ The | (b)(7)(E) | file contained the 

data fields: user login; password (which was encrypted); user e-ir.ail; 
and subscription date. The | (b)(7)(E) | file contained the data 

fields: user IP address; user login; time/date stamp; and the action 
performed by the user. 




(b)(7)(E) 




(b)(7)(E) 

|. This data fJ 

.ow displays a specil 

:ic c 

us tome r paid : 

:or 


access to a member restricted child exploitation image website through 
an identified PayPal account and accessed the member restricted 
website. The investigation has developed 55 subscriber leads from this 
analysis . 


SUBSCR I BKRS WITH 0N1.Y PAY PA I. TRANSACT IONA I. I.OG RECORDS: 


<b)(7>(E> 


| (b)(7)(E) Those specific member restricted 

child exploitation imago websites can be identified ir: the PayPal 
transactional logs by Lhe subject identifiers jtili/.ed by the criminal 
organization. A review of the PayPal transactional records for the 
above listed PayPal accounts identified approximately 1,121 u.S. 
customers that paid money to one of the identified PayPal accounts for 
one of the identified subject identifiers. 


This investigation is a joint investigation between ICS/C3/CES, 

ICE /RAC /Birmingham, the U.S. Postal Inspection Service, the U.S. 
Department of Justice, Child Exploitation and Obscenity Section, and 
the ~J.S. Attorney's Office for the Northern District of Alabama. The 
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as r from e-mail u . “ S L The member 

rp «. ^' JT ■■ r tV‘d h ~ '' ' tT -va <» -n-ar-H J *n pri ' *33 A" J WIJIHto a i u BMU — I 

ie.si.i.u..eu w..d„_ i.e -vas -u>.di...j di. l^jiBeaaea. aahts tM3X 1 8 "sc &35flmiEedecaUfidJ~ 

partial capture of the website was made and the 1,000 downloaded imag< 
were forwarded l.o NCMKC Tor i dent i r i cat i on against their Child victim 
Identification Program (CVIP) , which revealed that of this sampling, 
171 images were of child victims previously identified by law 
enforcement investigations 

in June 2006, l CK/C3/CKS received information via spam, e-mail regardii 
another commercial child exploitation image website, also known as 
" This information provided a location of 

The advertising website contained identical 
; the advertising website listed above; both known . 
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subj cct idcnt i f icr |] 


Mwavifiiis 


isociat.ed. wi 
] is known as 
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I ^"n l : Th'g member t e slr : cied webs ' e a ssociated 
with the subject identifier | Q gna>t/> and ?_TTifTI is known as 

* 1 If.?!*!.:-.. I - " The member restricted website contained the following 

sections: "Home;" "updates;" "Hardcore;" "Softcore;" "video;" "Site 
Support;" and "Logout." There were numerous galleries contained within 
the "Hardcore," "Softcore," and "video" sections. A partial capture of 
the member restricted website was obtained to include the entire 
subdirectory "Video." The "Video" subdirectory contained eight video 
files and the following folders: "Hoys;" "l.ong;" "Hreteen Action;" and 
"Small." There were a total of 44 video files in the "Video" 
subdi rectory. The video files dep i cued J ° i g')" U r Vl ^ncLT)c ^'"li I 
I t n w'-^Tp I - The video files were not submitted 

to NCMEC. The following descriptions provide a sample of the content 
in the member restricted website: 



Page 15 of 929 


















Page 16 of 929 


























(b)(7)(E) 



(b)(7)(E) 

_|. This data flow displays that, a specifi 

c oust 

omer 


paid for access to a member restricted child exploitation image website 
through an identified PayPal account and accessed the member restricted 
website. The investigation has developed 55 subscriber leads from this 
ana', ys i s . 


(b)(5) 


SUBSCRIBERS WITH ONLY PAYPAL TRANSACTIONAL LOG RECORDS WITH 
KNOWN/UNKNOWN SUBJECT LINE IDENTIFIERS: 














(b)(7)(E) 


| (b)(7)(E) | . " A review of the 

PayPal transactional records for the above listed PayPal accounts 
identified approximately 2,5-13 U.S. customers that paid money to one of 
t he identif ied PayPal accounts with the subject line identifier 
' j (b)(7)(E) | . " It appears consistent that the identified PayPal accounts 

are almost exclusively used to facilitate payment for child pornography 
ir.eir.be r restricted websites. 
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(b)(5) 


S'l'A'i'JS : 

This investigation is a joint investigation between ICZ/C3/CES, 

ICE. /RAC /Birmingham, the U.S. Postal Inspection Service, the II. S. 
Department of Justice, Child Exploitation and Obscenity Section, and 
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Project Flicker (2S2) - Commercial Child Exploitation Website Investigation 

In April 2006, the Immigration and Customs Enforcement (ICE), Cyber Crimes Center 
(C3), Child Exploitation Section (CES) initiated an investigation into a criminal 
organizatio n operating a commercial child exploitation website known as '°l 
I - ^iwt ” The investigation quickly revealed that the same organization is operating in 
excess of 200 commercial child exploitation websites. In addition, the organization 
utilizes various PayPal accounts to process the payments for access to the member 
restricted websites. The first PayPal account identified was in Birmingham, Alabama. 

The investigation is being worked jointly with ICE/C3/CES, ICE/RAC/Birmingham, the 
U.S. Postal Inspection Service, the Federal Bureau of Investigation (FBI), the U.S. 
Department of Justice (DOJ), Child Exploitation and Obscenity Section (CEOS), and the 
United States Attorney’s Office (USAO) for the Northern District of Alabama. 

The investigation initially focused on 14 U.S. based PayPal account holders that were 
collecting the proceeds from the subscription payments. Between April 2006 and 
September 2007, ICE/C3/CES I (b)(7)(E) | 

(b)(7)(E) I 

(b)(7)(E) [ During July/August 2007, 

ICE/RAC/Birmingham led several ICE field offices in the execution of search warrants 
and interviews of 13 out of the 14 PayPal account holders. It was assumed that these 
PayPal account holders had no knowledge of the child exploitation websites, which was 
confirmed through the enforcement action. All of the U.S. based PayPal account holders 
that were interviewed admitted that they were collecting payments using their PayPal 
accounts; but all thought they were collecting payments for software websites. Two 
different recruitment methods were discovered: one utilized online resume posting and 
the other online auctions. To date, XXX has been seized/abandoned as a result of the 
enforcement actions. The USAO for the Northern District of Alabama will likely not 
pursue criminal charges against any of the U.S. based PayPal account holders. 

The investigation and the interviews of the U.S. based PayPal account holders revealed 
that the criminal organization behind the commercial child exploitation websites was 
located somewhere in Eastern Europe. ICE/C3/CES and ICE/RAC/Birmingham were 
reviewing evidence obtained from the PayPal account holders as well as from various 
search warrants to try to determine the country of origin. Initial leads provided 
information that the individuals in the criminal organization were operating from Belarus 
and Latvia. ICE/Attachc/Frankfurt was asked to assist with the Eastern European 
connections. In addition, in August 2007, ICE/C3/CES was contacted by the FBI 
Innocent Images Unit (IIU) regarding an investigation being conducted by the Ministry of 
Internal Affairs of Belarus. The FBI/IIU operates an International Task Force from their 
location in Calvcrton, Maryland. This task force invites law enforcement officials from 
various countries to come to FBI/IIU for six months to learn investigative techniques and 
establish working relationships. One of the officers from the Ministry of Internal Affairs 
of Belarus was assigned to the task force for six months. Upon returning to Belarus he 
initiated an investigation into a criminal organization that was operating in excess of 200 
different commercial child exploitation websites which utilized U.S. based PayPal 
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accounts to collect the subscription proceeds. The Belarusian task force officers 
contacted FBI/IIU for assistance with their investigation since the PayPal account holders 
were all based in the U.S. Through the relationship ICE/C3/CES has developed with 
FBI/IIU, ICE/C3/CES was contacted regarding the Belarusian investigation. 

ICE/C3/CES and FBI/IIU determined that working jointly would be the best solution to 
assist with the Belarusian investigation, as both offices were working to dismantle 
international criminal organization operating commercial child exploitation websites. 

Working jointly, ICE/C3/CES and FBI/IIU arranged a meeting in Kyiv, Ukraine to 
discuss the U.S. and Bclarusian/Ukrainian investigation and to see how U.S. law 
enforcement could assist the Belarusian investigation. This meeting was facilitated by 
FBI/Legat/Kyiv and ICE/ Attache/Frankfurt. The meeting was extremely productive, 
resulting in an agreement between the U.S. law enforcement officials and the 
Bclarusian/Ukrainian law' enforcement officials to work together to dismantle the 
criminal organization operating in Belarus and the Ukraine. The Belarusian investigation 
had identified approximately seven individuals responsible for collecting the subscription 
proceeds from all of the various payment mechanisms (including the U.S. based PayPal 
accounts). These seven individuals were also thought to managc/control approximately 
12 individuals designated as web masters. These web masters controlled the actual child 
exploitation content and managed the various advertising and member restricted 
websites. The Belarusian investigation was targeting, at a minimum, the seven identified 
individuals responsible for managing the proceeds and the web masters. 

The U.S. based investigation will continue to work with the evidence obtained from the 
various interviews and search warrants to determine if any other U.S. based entities were 
involved in the distribution of the child exploitation material. In addition, ICE and the 
FBI will continue to work closely with the Belarusian/Ukrainian officials to assist in their 
investigation and process any information/evidence obtained during their planned 
enforcement action. It is anticipated that U.S. agents will travel to Belarus and the 
Ukraine to review evidence and obtain additional information about the criminal 
organization. 

It should be noted that| (b)(7>(E> 

I (b)(7)(E) | 

| (b)(7)(E) | . The FCACP is a partnership sponsored by the 

National Center for Missing and Exploited Children (NCMEC) that brings together 
financial industry members, NCMEC, and federal law enforcement agencies with the 
goal of eradicating commercial child exploitation. ICE/C3/CES was the first federal law' 
enforcement agency to participate in the FCACP beginning in April/May 2006. The 
FBI/IIU joined the FCACP in January 2007. Both ICE/C3/CES and FBI/IIU have 

j (b)(7)(E) I 


In is anticipated that if the Belarusian investigation is successful, approximately 85-90% 
of the commercial child exploitation websites will be dismantled. It is assumed that the 
members of the criminal organization that have not been identified will be unable to 
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reorganize to the same level they arc currently operating. So while it is assumed that 
some of the commercial child exploitation websites will come back online, there will not 
be the same level of control and organization. This should effectively reduce the number 
of domestic subscribers as the commercial supply will be greatly restricted. 1CE/C3/CES 
and FBI/IIU have committed to continue working with the Bclarusian/Ukrainian officials 
to dismantle any future attempt to organize the commercial child exploitation industry. 


The following points provide a timeline of past and future (anticipated) action: 


April 2006: 1CE/C3/CES initiates Project Flicker; bcgins|~ 


June 2006: ICE/C3/CES identifies the first PayPal account holder collecting 
proceeds for the monthly subscriptions - location Birmingham, Alabama 
July/August 2006: ICE/C3/CES briefs ICE/RAC/Birmingham on the investigation 
and initiates a collateral request to have them open an investigation. In addition, 
the USAO for the Northern District of Alabama is briefed. The 
USPIS/Birmingham is brought in to the investigation to assist 
IC'E/RAC/Birmingham. 

January 2007: FBI/IIU begm S | «»> Sg g gBS S 


S .tiiliann IFsrtprnl Virtima' Prnlpntmn nnri Rinhla 


1 r.ghts iy 


I I 'mlia'lmu flflfl aiflola aCu 

ICE/C3/CES briefs 


FBI/IIU about the investigation. 

February-April 2007: ICE/C3/CES prepares over 4,900 domestic leads of 
individuals that subscribed to one or more of the 200+ commercial child 
exploitation websites utilizing one of the 14 U.S. based PayPal accounts. 

April 2007: Project Flicker is presented to the Attorney General’s Advisory 
Committee for Child Exploitation (AGAC). The AGAC approves the national 
operation and transmits its recommendation and guidance to the USAOs. 
ICE/C3/CES disseminates in excess of 4,900 domestic leads to the ICE field 
offices. As of November 6, 2007, there were 615 open investigations, resulting in 
5 1 arrests, 29 indictments, 8 convictions, and 1 85 search warrants. The 
international leads arc being prepared for dissemination. 

July/August 2007: ICE/RAC/Birmingham led several ICE field offices in the 
execution of search warrants and interviews of 13 out of the 14 U.S. based PayPal 
account holders. The enforcement action resulted in several seizures and 
abondanments. 


August 2007: FBI/IIU contacted by the Ministry of Internal Affairs for Belarus 
regarding an investigation into a criminal organization operating multiple child 
exploitation websites that utilize U.S. based PayPal accounts to facilitate the 
subscriber payments. The FBI/IIU contacts ICE/C3/CES due to the overlap 
between Project Flicker and the Belarusian investigation. It is determined that 
FBI/IIU will continue to communicate with the Belarusian authorities and 
coordinate a meeting between U.S. law enforcement and Bclarusian/Ukrainian 
law enforcement. 

October 2007: Meeting between FBI/IIU, FBI/Legat/Kyiv, 
ICE/Attachc/Frankfurt, ICE/C3/CES, the Ministry of Internal Affairs of Belarus, 
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and the Ministry of Internal Affairs of Ukraine. It was determined that the U.S. 
law enforcement agencies would support the Belarusian/Ukrainian investigation 
in any manner possible. The Belarusian investigation targeted at least seven 
identified individuals. In addition, the Belarusian authorities provided additional 
U.S. subscriber leads to the FBI/1IU for dissemination. 

• October 2007: ICE/RAC/Birmingham initiated a collateral request to 
ICE/ Attache/Frankfurt regarding financial transactions from the U.S. based 
PayPal account holders. These financial transactions were the subscription 
payments from the U.S. based PayPal accounts being sent back to the criminal 
organization, utilizing financial institutions in Latvia. 



It is assumed that a press release will be appropriate sometime in January or February 
2008. This press release should include the outstanding commitment made by the 
financial industry partners and NCMEC. In addition, it should include all of the federal 
law enforcement partners to avoid any duplicate press releases and to ensure that no 
contradictory information is being released. It should also be coordinated with the USAO 
for the Northern District of Alabama as they arc the primary USAO handling Project 
Flicker. Any press release must be coordinated with ICE/C3/CES, FBI/IIU, 

ICE/ Attache/Frankfurt, and FBI/Legat/Kyiv to ensure that there is no premature release 
of investigative information. We want to ensure that our foreign counterparts arc ready 
for any press release in the U.S. In addition, the names of any law enforcement officers 
involved in Project Flicker should not be released to the media. 

The following individuals arc primary points of contact for Project Flicker: 

National Program Manager/Senior Special Agent | (b>(B>,(b>(7>(c | 

ICE/Cyber Crimes Center/Child Exploitation Section 

Senior Special Agcnt | ib)iSMb)(7)(C) | 

ICE/Residenl Agent-in-Charge/Birmingham 

Special Agcnt | (b»:s l: (b)(7)(C) | 

Federal Bureau of Investigation/Innocent Images Unit 
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Postal Inspector [(b)(6), (b)(7; | 

U.S. Postal Inspection Service/Birmingham, Alabama 

ICE Assistant Attache |~ (b)(6), (b)(7)(c) ~| 

1C E/Attachc/F rankfurt 

ICE Assistant Attache r (b)(6), (b)(7)(c) | 

ICE/Attachc/Frankfurt (Copenhagen) 
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ICE investigation exposes vast child pornography ring and involves 
VGT partners in subsequent operation 

Operation Basket is a Virtual Global Task Force (VGT) coordinated operation targeting 
230 commercial child pornography websites that were under the control of one criminal 
organization. It grew out of an ICE operation called Project Flicker. 

Flicker, which began in 2006 with a tip from the U.S. Immigration and Customs 
Enforcement CyberTipline, investigated the criminal organization behind hundreds of 
child pornography Websites, ultimately identifying 30.000 customers in 1 32 countries, 
achieving hundreds of U.S. convictions, and 16 arrests in Belarus and the Ukraine. 

The criminal rings involved used a variety of online and traditional payment methods, 
elaborate defense measures and a franchise business model that provided access to 
images and videos of sexually exploited boys and girls, some as young as 3 years old. 

The initial information identified payment mechanisms used by the criminal organization 
to sell memberships to these child exploitation sites. 

The operation initially sought to uncover the details of these payment mechanisms in 
order to identify members of the organization. 

Operation Flicker: 

■ recorded the sites, 

■ conducted test purchases to gain membership access, 

■ traced the illegal proceeds, 

■ coordinated with international partners via the VGT, 

■ disseminated subscriber leads, and finally, 

■ with the help of international partners, took enforcement action against the 
criminal organization. 

In October 2007, the FBI alerted ICE that Belarusians were investigating PayPal accounts 
connected to child exploitation sites. ICE made the connection to its investigation. 

Eleven members of the child pom ring were located in Belarus and arrested in 2008. 

They have been convicted and received sentences of between 3 and 12 years. 

In January 2010, Ukrainian authorities arrested five more individuals. 

Ultimately, Operation Basket involved the United States, Canada, England, Italy, 

Belarus, Ukraine, Australia, Interpol and Europol in what is believed to be the most 
sophisticated commercial child exploitation enforcement to date. 

Since the websites went offline in January, the number of active commercial child porn 
sites has plummeted from perhaps 300 to the single digits, or what ICE estimates to be 95 
percent fewer commercial child pornography websites. 
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Project Flicker 


Among the U.S. child-scx image buyers identified by the investigation were doctors, 
police officers, sheriff's deputies, school teachers, attorneys and church preachers. Also 
identified were Department of Defense personnel or contractors, including several with 
top-sccrct security clearances. On September 15, 2010, Pentagon officials announced 
they were reopening their investigation into 264 Defense employees or contractors who 
accessed these websites. 

Leads on the American purchasers triggered more than 500 search warrants and at least 
280 convictions, involving several federal agencies. Others were convicted by state or 
local authorities. 

The investigation has identified and shared with law enforcement around the country and 
around the world the identities of approximately 5,200 domestic subscribers and 4,400 
international subscribers of child exploitation websites. 

Many of the images were recycled from LS and BD studios, giant Ukrainian producers of 
child pornography that were broken up by law enforcement in 2004. 

The lion’s share of images and videos arc disseminated for free between individuals, who 
often belong to trust-based clubs. 

Though different sites provided images and videos focusing on different fetishes, they 
held many similarities. For one, they had a common design and method of payment. 

Initially, buyers visiting different sites were steered to a common credit-card processing 
website. But that site was actually a sham. After purchasers provided personal detail and 
credit card information on this fake payment site, they were led to a PayPal account to 
make the real payments. 

ICE estimates the rings made between S5 million to $8 million from early 2006 until late 
2007. 

The ring used an elaborate system, including: 

— Countless free “teaser” sites, which had a few images of mostly or completely naked 
children, and wore meant to lure child-pornography seekers to pay for ’'memberships" 
that gave them access to the images. Subscriptions cost between $79.95 and $99.95 a 
month. 

— A fake payment processing company. On its face, it looked like a legitimate charge- 
card transaction processor, but its only purpose was to gather credit card information, 
which w'as then used to pay for hosting other child exploitation websites; 
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— Between 1 4 and. 40 American “mules” who unknowingly processed some 65,000 child 
pornography transactions over PayPal and funnclcd the money back to the ring. They 
have not been prosecuted. 


Flicker statistics: 

ICE’s Cyber crimes Center (C3) sent U.S. -based leads to ICE Field offices around the 
country; some involving the use of government computers were referred to other federal 
agencies. If eases were worked by different federal agencies, they arc nevertheless 
included in the ICE final numbers for statistical purposes. 

Since 2006 there have been: 

• 416 criminal arrests 

• 5 administrative arrests 

• 343 indictments 

• 348 convictions 

• 1,142 seizures 


More than 5,000 U.S. leads arc being followed; 4,000 foreign leads were shared with 
international law enforcement partners 

Foreign leads would have been sent to the appropriate ICE Attache offices (we have 64 
worldwide). 
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REQUESTED BY : Q 


OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 

TECS RECORD ID: I (b)(7)(E) | 


SUB RECORD 01 


*** IDENTIFYING INFORMATION ========== 

NAME: | (b)(6), (b)(7)(C) ® JUNO . COM 

*** DESCRIPTIVE INFORMATION ========== 

*** ADDRESS AND TELEPHONE INFORMATION; 

*** INFORMATION ON OFFICERS ========== 

*** OTHER INFORMATION ================ 


FIN ID: DATE: 20 

*** REC ORD 
STATUS: I (b)(7) 

AGENCY: I ® 

TELEPHONE: 2 05 2 9 1(b)(6), (b)(7)(j TITLE: 

DATE ENTERED: 073106 LAST UPDATE: 092211 

CASE NUMBER: | (b)(7)(E) | 

REMARKS : 

EMAIL ACCOUNT UTILIZED IN RELATION TO A WEBSITE OFFERING HUNDREDS OF IMAGES 
OF CHILD PORNOGRAPHY. 

*** PRIMARY ACCESS INFORMATION============================================== 

LOOKOUT LEVEL: 


OWNERSHIP INFORMATION== ========================================= 

PREVIOUS SUSPECT, CLOSED CASE DATE: 092211 

ICE OI - BIRMINGHAM AL NAME: | (b)(6), (b)(7)(C) | 


OFFICIAL USE ONLY 


TECS II INFORMATION 
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REQUESTED BY : | (b)(6), (b)(7)(C) ~| 


OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: I (b)(7)(E) | SUB RECORD 02 


*** IDENTIFYING INFORMATION ==================================================== 

NAME: I (b)(6), (b)(7)(C) I ® JUNO . COM 

*** DESCRIPTIVE INFORMATION ==================================================== 

*** ADDRESS AND TELEPHONE INFORMATION=========================================== 

*** INFORMATION ON OFFICERS ==================================================== 

*** OTHER INFORMATION ===========================================*============== 

*** REC ORD O WNERSHIP INFORMATION================================================ 

STATUS: I (b)(7) [PREVIOUS SUSPECT, CLOSED CASE DATE: 022514 

AGENCY: I ® I ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: | (b)(6), (b)(7)(C) | 

TELEPHONE: 972 TITLE: 

DATE ENTERED: 062806 LAST UPDATE: 022514 

CASE NUMBER: I (b)(7)(E) | 

REMARKS : 

SUBJECT EMAIL LINKED TO PAYPAL ACCOUNT FACILITATING CHILD PORN PAYMENTS 

*** PRIMARY ACCESS INFORMATION================================================== 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 
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REQUESTED BY : | (b)(6), (b)(7)(C) | 


OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: I (b)(7)(E) | SUB RECORD 01 


*** IDENTIFYING INFORMATION ================================================= 

NAME: I (b)(6) (b)(7)(C) l @CHARTER.NET 

*** DESCRIPTIVE INFORMATION ================================================= 

*** ADDRESS AND TELEPHONE INFORMATION======================================== 

*** INFORMATION ON OFFICERS ================================================= 

*** OTHER INFORMATION ======================================================= 

FIN ID: DATE: 20 

*** REC ORD OWNERSHIP INFORMATION============================================= 

STATUS: [^PREVIOUS SUSPECT, CLOSED CASE DATE : 092211 

AGENCY: |_ ( ^ | ICE 01 - BIRMINGHAM AL NAME: I (b)(B>, (b)(7)(C) 1 

TELEPHONE: 205 29 I W ^\ UA ''I TITLE: 

DATE ENTERED: 073106 LAST UPDATE: 092211 

CASE NUMBER: | (b)(7)(E) | 

REMARKS : 

EMAIL ACCOUNT RELATED TO A SUBJECT WHO IS ALLEDGEDLY COLLECTING PAYMENTS FOR 
USERS ACCESS TO A WEBSITE CONTAINING HUNDREDS OF IMAGES OF CHILD PORNOGRAPHY. 

*** PRIMARY ACCESS INFORMATION=============================================== 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 
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REQUESTED BY : Q 


(b)(6), (b)(7)(C) 


OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 

TECS RECORD ID: I (b)(7)(E) | 


SUB RECORD 02 


*** I DENTIFYING I NFORMATION ============== 

NAME: | (b)(6), (b)(7)(C) | ®CHARTER . NET 

*** DESCRIPTIVE INFORMATION ============== 

*** ADDRESS AND TELEPHONE INFORMATION ==== 

*** INFORMATION ON OFFICERS ============== 

*** OTHER INFORMATION ==================== 


*** REOORI1 


OWNERSHIP INFORMATIONS 


STATUS: (b)(7) ^PREVIOUS SUSPECT, CLOSED CASE 
AGENCY: I ® I ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: 
TELEPHONE: 972 44 l w ^, Uft ''l TITLE: 

DATE ENTERED: 062806 LAST UPDATE: 022514 


DATE:' 022514 

| (b)(6), (b)(7)(C) | 


CASE NUMBER: | (b)(7)(E) | 

REMARKS : 

SUBJECT EMAIL LINKED TO PAYPAL ACCOUNT FACILITATING CHILD PORN PAYMENTS 


*** PRIMARY ACCESS INFORMATION: 
LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 
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*** I DENTIFYING INFORMATION === ============================================. 

NAME : |(b)(6), (b)(7)(C) ] 

* ** DESCRIPTIVE INFORMATION ================================================ 

*** ADDRESS AND TELEPHONE INFORMATION====================================== ; 

*** INFORMATION ON OFFICERS ===============================================< 

*** OTHER INFORMATION ====================================================== 

FIN ID: DATE: 20 


*** RECORD-OWNERSHIP INFORMATION========= 

STATUS: |(b)(7)|pREVIOUS SUSPECT, CLOSED CASE 
AGENCY: I (E> I ICE 01 - BIRMINGHAM AL 
TELEPHONE: 205 2 9 r A 7A UA "l TITLE: 

DATE ENTERED: 071207 LAST UPDATE: 092211 



CASE NUMBER: 


REMARKS : 

WEBSITE USED FOR PAY PAL TRANSACTIONS FOR CHILD PORNOGRAPHY 


*** PRIMARY ACCESS INFORMATION==== ========= 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 
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REQUESTED BY : £ 


(b)(6), (b)(7)(C) 


OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 

TECS RECORD ID: | (b)(7)(E) | 


SUB RECORD 01 


*** IDENTIFYING INFORMATION 
NAME: U£>( a > : Ia u.a.u. & abua(d) uh.id 


t« ri-.w<via 1 1 q n k ifbHb, I 


*** DESCRIPTIVE INFORMATION 


*** ADDRESS AND TELEPHONE INFORMATION - 


*** INFORMATION ON OFFICERS ================================> 

*** OTHER INFORMATION ======================================: 


FIN ID: DATE: 20 

*** REC ORD O WNERSHIP INFORMATION= ======================================== =: 

STATUS: | (b)(7) |PREVIOUS SUSPECT, CLOSED CASE DATE: 092211 

AGENCY: I (E> I ICE 01 - BIRMINGHAM AL NAME: | (b>(B> (b> ( 7>(c> | 

TELEPHONE: 205 2 9 r A 7A UA "l TITLE: 

DATE ENTERED: 091806 LAST UPDATE: 092211 

CASE NUMBER: I (b)(7)(E) | 

REMARKS: 

WEBSITE IS AN ADVERTISING SITE FOR A MEMBERS ONLY CHILD PORNOGRAPHY SITE. 


*** PRIMARY ACCESS INFORMATION; 
LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 
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REQUESTED BY : 1(b)(6), (b)(7)(C) 


OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
TECS II ORGANIZATION SUBJECT 


TECS RECORD ID: 


SUB RECORD 02 



*** REC ORD O WNERSHIP INFORMATIONS ====== ========== 

STATUS: I (b)(7) [PREVIOUS SUSPECT, CLOSED CASE 
AGENCY: JL ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: 
TELEPHONE: 972 44 l l “*7A“* ,, l TITLE: 

DATE ENTERED: 081106 LAST UPDATE: 022514 


DATE: 022514 


REMARKS : 

SUBJECT WEBSITE IS AN ADVERTISING WEBSITE ASSOCIATED WITH A CHILD PORN 
MEMBER ONLY WEBSITE KNOWN AS HOME COLLECTION 


*** PRIMARY ACCESS INFORMATION: 
LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 
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(b)(6), (b)(7)(C) | 


REQUESTED BY : [ 

OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: I (b)(7)(E) | SUB RECORD 01 


*** IDENTIFYING INFORMATION ======================== ================,======. 

NAME: L 3 ?.^ , I 

*** DESCRIPTIVE INFORMATION ==============================================; 

*** ADDRESS AND TELEPHONE INFORMATION=============== = ==========:==r========= i 

*** INFORMATION ON OFFICERS =================== ==================:=========: 

*** OTHER INFORMATION =========================== ================.-=========. 

*** REC ORD OWNERSHIP INFORMATION==========================================; 

STATUS: |(b)(7>|PREVIOUS SUSPECT, CLOSED CASE DATE: 092211 

AGENCY: I (E) I ICE 01 - BIRMINGHAM AL NAME: I (b)(6), (b)(7)(C) 1 

TELEPHONE: 2 05 29 l w> m m ua,, I TITLE: 

DATE ENTERED: 042307 LAST UPDATE: 092211 

CASE NUMBER: I <b)(7) (E ) I 

REMARKS : 

SUBJECT WEBSITE IS AN ADVERTI SING WEBSITE ASS OCIATED WITH A MEMBER ONLY 
CHILD PORN WEBSITE KNOWN AS ffla'aggSgl 

*** PRIMARY ACCESS INFORMATION=== ============================ =============: 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 
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REQUESTED BY s Q 


□ 


OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: I (b)(7)(E) | 


SUB RECORD 02 


*** IDENTIFYING INFORMATION =================================== 

NAME: 

*** DESCRIPTIVE INFORMATION =================================== 

*** ADDRESS AND TELEPHONE INFORMATION^ ============= ===========; 


*** INFORMATION ON OFFICERS ========================== 

*** OTHER INFORMATION ================================ 


RECQEIL 


OWNERSHIP I NFORMAT I ON = 


STATUS: (b)(7) PREVIOUS SUSPECT, CLOSED CASE 
AGENCY: < E > ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: 

TELEPHONE: 972 44 l' un 7A liA ''l TITLE: 

DATE ENTERED: 081106 LAST UPDATE: 022514 


DATE: 022514 

b)(B) (b)(7)(C) | 


CASE NUMBER; I (b)(7)( E T 


REMARKS : 

SUBJECT WEBSITE IS AN ADVER TISING WEBSITE AS SOCIATED WITH A MEMBER ONLY 
CHILD PORN WEBSITE KNOWN AS BSSSSS] 

*** PRIMARY ACCESS INFORMATION========================================== 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 
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*** PRIMARY ACCESS INFORMATION: 
LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 
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REQUESTED BY : | : s>,(b> ji | 

OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: | (b)(7)(E) | SUB RECORD 01 

*** IDENTIFYING INFORMATION ==================================================== 

NAME: t.!^ I 

*** DESCRIPTIVE INFORMATION ==================================================== 

** * ADDRESS AND TELEPHONE INFORMATION= ===========================--============== 

*** INFORMATION ON OFFICERS ==================================================== 

*** OTHER INFORMATION ========================================================== 

*** RECORD-OWNERSHIP INFORMATION================================================ 

STATUS: | (b)(7) |PREVIOUS SUSPECT, CLOSED CASE DATE: 092211 

AGENCY: I (E) I ICE 01 - BIRMINGHAM AL NAME: | (b>(G>,(b>(7>(C> | 

TELEPHONE: 2 05 2 9 r A 7A Ufl "l TITLE: 

DATE ENTERED: 042307 LAST UPDATE: 092211 

CASE NUMBER: | (b)(7)(E) | 


REMARKS : 

SUBJECT WEBSITE ADVERTISE COMMERCIAL ACCESS TO A MEMBER RESTRICTED CHILD 
PORNOGRAPHY WEBSITE; PAYMENT FACILIATED THROUGH PAYPAL 

*** PRIMARY ACCESS INFORMATION=========================================== 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 
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REQUESTED BY : Q 


(b)(6), (b)(7)(C) 


OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 

TECS RECORD ID: I (b)(7)(E) 1 


SUB RECORD 02 


*** IDENTIFYING INFORMATION ==================================================== 

NAME: 

*** DESCRIPTIVE INFORMATION ==================================================== 

*** ADDRESS AND TELEPHONE INFORMATION=========================================== 

*** INFORMATION ON OFFICERS ==================================================== 

*** OTHER INFORMATION ========================================================== 


REC ORD O WNERSHIP INFORMATION 


STATUS: I (b)(7) PREVIOUS SUSPECT, CLOSED CASE 
AGENCY: I (E> I ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: □ 
TELEPHONE: 972 44 1 TITLE: 

DATE ENTERED: 102406 LAST UPDATE: 022514 


DATE : 

(b)(6), (b)(7)(C) | 


CASE NUMBER: | (b)(7)(E) | » 

REMARKS : 

SUBJECT WEBSITE ADVERTISE COMMERCIAL ACCESS TO A MEMBER RESTRICTED CHILD 
PORNOGRAPHY WEBSITE; PAYMENT FACILIATED THROUGH PAYPAL 


*** PRIMARY ACCESS INFORMATION======: 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 
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REQUESTED BY : | (b)(6), (b)(7)(C) ~| 

OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: | (b)(7)(E) | SUB RECORD 01 

*** IDENTIFYING INFORMATION ==================================================== 

NAME: I 

*** DESCRIPTIVE INFORMATION ==================================================== 

*** ADDRESS AND TELEPHONE INFORMATION=========================================== 

*** INFORMATION ON OFFICERS ==================================================== 

*** OTHER INFORMATION ========================================================== 

*** REC ORD OWNERSHIP INFORMATION================================================ 


STATUS; 1 (b)(7) [PREVIOUS SUSPECT, CLOSED CASE 
AGENCY: 1 ® 1 ICE 01 - BIRMINGHAM AL 

NAME: Q 

DATE: 092211 

(b)(6), (b)(7)(C) | 

TELEPHONE: 205 29I™W"'"I TITLE: 

DATE ENTERED: 042307 LAST UPDATE: 092211 




CASE NUMBER: I warn \ 

REMARKS : 

SUBJECT WEBSITE IS A COMMERCIAL CP WEBSITE LINKED TO THE CURRENT INVESTIGATION 
THROUGH IDENTICAL PAYMENT METHODS (PAYPAL ACCOUNTS) 

*** PRIMARY ACCESS INFORMATION================================================= 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 
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REQUESTED BY : | (b)(6), (b)(7)(C) | 

OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: I (b)(7)(E) | ‘ SUB RECORD 02 


*** IDENTIFYING INFORMATION ==============================================: 

NAME: 

*** DESCRIPTIVE INFORMATION =============================================== 

*** ADDRESS AND TELEPHONE INFORMATION= ================================ ====; 

*** INFORMATION ON OFFICERS ==============================================; 

*** OTHER INFORMATION ==================================================== 

*** RECORD-OWNERSHIP INFORMATION========= =========================== ======; 

STATUS: |(bX7)|pREVIOUS SUSPECT, CLOSED CASE DATE: 022514 

AGENCY: I (E> I ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: | (b>(6>,(b>(7>(C> | 

TELEPHONE: 972 44 1 IL,,l ^A Lin,; I TITLE: 

DATE ENTERED: 102406 LAST UPDATE: 022514 

CASE NUMBER: I (b)(7)(E) I 

REMARKS : 

SUBJECT WEBSITE IS A COMMERCIAL CP WEBSITE 

*** PRIMARY ACCESS INFORMATION— === = = = = = = = = = = ================= ======= ==== = : 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 
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REQUESTED BY : 1 (bj s>, (b)(7)(C) | 

OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: I (b)(7)(E) | SUB RECORD 01 


*** IDENTIFYING INFORMATION ==================================================== 

NAME: IS, 1 

*** DESCRIPTIVE INFORMATION ==================================================== 

*** ADDRESS AND TELEPHONE INFORMATION======================= === ===========: ====== 

*** INFORMATION ON OFFICERS ==================================================== 

*** OTHER INFORMATION ========================================================== 

*** RECORD-OWNERSHIP INFORMATION================================================ 

STATUS: I (b)(7) IpREVIOUS SUSPECT, CLOSED CASE D ATE: 022514 

AGENCY: I (i) I ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: | (b>(6>,(b> ( 7>(C> | 

TELEPHONE: 972 44 l w ^ u,u, l TITLE: 

DATE ENTERED: 102406 LAST UPDATE: 022514 

CASE NUMBER: I (b)(7)(E) | 

REMARKS : 

SUBJECT WEBSITE IS A COMMERCIAL CP WEBSITE 

*** PRIMARY ACCESS INFORMATION================================================== 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 
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REQUESTED BY : Q 


OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: | (b)(7)(E) | SUB RECORD 01 


*** IDENTIFYING INFORMATION ========== 

NAMF • I (b)(3): IH U.B.U. & abUy(d) Uh.ldv.chms' and I 

I rhilH rinhts 1« lllf S I 

*** DESCRIPTIVE INFORMATION ========== 

*** ADDRESS AND TELEPHONE INFORMAT I ON = 
*** INFORMATION ON OFFICERS ========== 

*** OTHER INFORMATION ================ 


*** RECORD-OWNERSHIP INFORMATION=== ========================= ==================; 

STATUS: | (b)(7) |pREVIOUS SUSPECT, CLOSED CASE DATE: 092211 

AGENCY: I (E> I ICE 01 - BIRMINGHAM AL NAME: | (b)(6), (b)(7)(C) 1 

TELEPHONE: 205 29 l wl 7A“' l,, l TITLE: 

DATE ENTERED: 042307 LAST UPDATE: 092211 

CASE NUMBER: | (b)(7)(E) | 

REMARKS : 

SUBJECT WEBSITE IS A COMMERCIAL CP WEBSITE LINKED TO THE CURRENT INVESTIGATION 
THROUGH IDENTICAL PAYMENT METHODS {PAYPAL ACCOUNTS) 

*** PRIMARY ACCESS INFORMATION== ============================================= = ; 

LOOKOUT LEVEL : 


OFFICIAL USE ONLY 


TECS II INFORMATION 
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OFFICIAL USE ONLY 



REQUESTED BY : | (b)(6), (b)(7)(C) 


OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 

TECS RECORD ID: I (b)(7)(E) | 


SUB RECORD 02 


*** IDENTIFYING INFORMATION ================================= 

NAME: I I 

*** DESCRIPTIVE INFORMATION ================================= 

*** ADDRESS AND TELEPHONE INFORMATION======================== 

*** INFORMATION ON OFFICERS ================================= 


*** OTHER INFORMATION =========================== 


RECORD 


STATUS : 
AGENCY : 


.OWNERSHIP INFORMATION 


(bK?) Previous suspect, closed case 

| ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: ["" 

TELEPHONE: 972 44 1 '“"r 1 ' 1 1 TITLE: 

DATE ENTERED: 102406 LAST UPDATE: 022514 


DATE: 022514 


CASE NUMBER: | (b)(7)(E) | 

REMARKS : 

SUBJECT WEBSITE IS A COMMERCIAL CP WEBSITE LINKED TO THE CURRENT INVESTIGATION 
THROUGH IDENTICAL PAYMENT METHODS (PAYPAL ACCOUNTS) 


*** PRIMARY ACCESS INFORMATION========= 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 
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REQUESTED BY : | (b)(6), (b)(7)(C) [ 

OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: | (b)(7)(E) | SUB RECORD 01 


*** IDENTIFYING INFORMATION ===== ========================*=========;============= = 

NAME: SICK CHILD EEifti (M(I)ICA I 

*** DESCRIPTIVE INFORMATION =====================================£============== 

*** ADDRESS AND TELEPHONE INFORMATION=========================================== 

*** INFORMATION ON OFFICERS ==================================================== 

*** OTHER INFORMATION =========================================================== 

*** REC ORD O WNERSHIP INFORMATION================================================ 

STATUS: | (b)(7) |PREV I OUS SUSPECT, CLOSED CASE DATE: 092211 

AGENCY: I ® I ICE 01 - BIRMINGHAM AL NAME: | (b>(S>, ( b>(7>(C> | 

TELEPHONE: 205 29 l wl 7A u,l "l TITLE: 

DATE ENTERED: 042307 LAST UPDATE: 092211 

CASE NUMBER: | (b)(7)(E) | 

REMARKS : 

SUBJECT WEBSITE IS A COMMERCIAL CP WEBSITE LINKED TO THE CURRENT INVESTIGATION 
THROUGH IDENTICAL PAYMENT METHODS (PAYPAL ACCOUNTS) 

*** PRIMARY ACCESS INFORMATION================================================== 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 
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REQUESTED BY: 



*** IDENTIFYING INFORMATION 
NAME: I Zl I 


*** DESCRIPTIVE INFORMATION ================, 

*** ADDRESS AND TELEPHONE INFORMATION======- 

*** INFORMATION ON OFFICERS ================< 


*** OTHER INFORMATION 


*** RECQRD—OWNERSHI P INFORMATION=================- 

STATUS: I (b)(7) IpREVIOUS SUSPECT, CLOSED CASE 
AGENCY: I (E> I ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: 
TELEPHONE: 972 44 l(b)(6),(b)(7xl TITLE: 

DATE ENTERED: 102406 LAST UPDATE: 022514 


DATE: 


022514 


CASE NUMBER: 


REMARKS : 

SUBJECT WEBSITE IS A COMMERCIAL CP WEBSITE LINKED TO THE CURRENT INVESTIGATION 
THROUGH IDENTICAL PAYMENT METHODS {PAYPAL ACCOUNTS) 


*** PRIMARY ACCESS INFORMATION = 
LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 
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REQUESTED BY: | (b)(6), (b)(7)(C) | 

OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: | (b)(7)(E) ~| SUB RECORD 01 


*** IDENTIFYING INFORMATION ======================== = = =:===*==:=====!= ======:=====:=== 

name . I IUJUJ. 14 u.s.l. 5 juuuiuj uiiiu wuims unu | 

' I rhilH vi^noQQQQ' rinh t « 1 « I I <3 f~ K ISHC I 

*** DESCRIPTIVE INFORMATION ======================== ======:= =======!==!=====:===!==!== 

*** ADDRESS AND TELEPHONE INFORMATION============================«============== 

*** INFORMATION ON OFFICERS ==================== = ========== = =:================ === 

*** OTHER INFORMATION ============================================ K ============== 

*** RECORD OWNERSHIP INFORMATION======== =========== ======:====«==-«============ 

STATUS: |(b>(7)|PREVIOUS SUSPECT, CLOSED CASE DATE: 022514 

AGENCY: I (E> I ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: | (b>(S>,(b>(7> ( c> | 

TELEPHONE: 972 44 l wl 7A J,l,, l TITLE: 

DATE ENTERED: 102406 LAST UPDATE: 022514 

CASE NUMBER: | (b)(7)(E) | 

REMARKS : 

SUBJECT WEBSITE IS AN CP ADVERTISING WEBSITE LINKED TO THE 
INVESTIGATION; UTILIZES PAYPAL TO FACILIATE THE MEMBER ACCESS 

*** PRIMARY ACCESS INFORMATION===================================^============== 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 

Page 48 of 929 



REQUESTED BY : | (b)(6), (b)(7)(C) 


OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: I (b)(7)(E) | SUB RECORD 01 


*** IDENTIFYING INFORMATION ==================================================== 

NAMF ■ I mif - 1 a u.s.L. S umia victims anti i 

1 ' I -hilH ■Mtnoaaoa' rinhta 18 I I <3 T 8 -11(10 l 

*** DESCRIPTIVE INFORMATION ==================================================== 

*** ADDRESS AND TELEPHONE INFORMATION=========================================== 

*** INFORMATION ON OFFICERS ==================================================== 


*** OTHER INFORMATION ===========================; 


*** RECORD. 
STATUS : 
AGENCY 


.OWNERSHIP INFORMATION = 


(b)(7) 


■ PREVIOUS SUSPECT, CLOSED CASE 

ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: Q 
TELEPHONE: 972 44 l lU|i r )|,, l TITLE: 

DATE ENTERED: 102406 LAST UPDATE: 022514 


DATE: 022514 


CASE NUMBER: I (b)(7)(E) | 

REMARKS : 

SUBJECT WEBSITE IS AN CP ADVERTISING WEBSITE LINKED TO THE 1.,^ SSZSS3 
INVESTIGATION; UTILIZES PAYPAL TO FACILIATE THE MEMBER ACCESS 


*** PRIMARY ACCESS INFORMATION^ 
LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 

Page 49 of 929 


OFFICIAL USE ONLY 



(b)(6), (b)(7)(C) 


REQUESTED BY : [ 

OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: | (b)(7)(E) | SUB RECORD 01 

*** IDENTIFYING INFORMATION =======================================»==:====«===== 

NAME * I HUN)- 1* u.s.l. 5 juimuj uwu uiuviui unu | 

1M/U 16 . | philH **"*,',**■ rinht, lh\l*Y 1 « I I g P K ^nc, | 

*** DESCRIPTIVE INFORMATION = = = = = = = = = = = = = = = = = = = = ======= = = = = = = = =: = =: = = = = =: = = = = =: = = = = =: 

*** ADDRESS AND TELEPHONE INF0RMATI0N====================='=======«============== 

*** INFORMATION ON OFFICERS ===============:==============-====================== 

*** OTHER INFORMATION ========================================================== 

*** RECORD-OWNERSHIP INFORMATION======= ================================== ======= 

STATUS: | (b)(7) |pRE VI OUS SUSPECT, CLOSED CASE DATE: 022514 

AGENCY: I (E) I ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: | (b><6>, (b)(7)(C) | 

TELEPHONE: 972 44 l |U)I ” ,) I TITLE: 

DATE ENTERED: 102406 LAST UPDATE; 022514 

CASE NUMBER: | (b)(7)(E) | 


REMARKS : 

SUBJECT WEBSITE LINKED TO I ^ CP INVESTIGATION; LISTED 
AS PAYMENT URL - LEADING TO VARIOUS PAYPAL ACCOUNTS. 

*** PRIMARY ACCESS INFORMATION========= ============================ =========== 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 

Page 50 of 929 


OFFICIAL USE ONLY 



REQUESTED BY : f - ~l 


OFFICIAL USE ONLY 

041816 

TECS RECORD ID: | (b)(7)~ 


-- TECS II INFORMATION -- OFFICIAL USE ONLY 
TECS II ORGANIZATION SUBJECT PAGE 1 

j SUB RECORD 01 


*** IDENTIFYING INFORMATION ==================================================== 

NAMP • I mw i* u.s.l. 5 JaiMflj umia victims ana eniia witnesses i 

1C, . | ,-inhts (hUSVIS I I g r Pfntortinn I 

*** DESCRIPTIVE INFORMATION ==================================================== 

*** ADDRESS AND TELEPHONE INFORMATION ================================== ======== 

*** INFORMATION ON OFFICERS ==================================================== 

*** OTHER INFORMATION ========================================================== 


*** REC ORD O WNERSHIP INFORMATION================^ 

STATUS: (b)(7) PREVIOUS SUSPECT, CLOSED CASE 
AGENCY: (E) ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: 

TELEPHONE: 972 44 l^7A Ufl,/ l TITLE: 

DATE ENTERED: 102406 LAST UPDATE: 022514 

CASE NUMBER: | (b)(7)(E) | 


DATE: 022514 

(b)(6), (b)(7)(C) | 


REMARKS : 

SUBJECT WEBSITE ASSOCIATED WITH I CP INVESTIGATION; 

LISTED AS ADMINISTRATIVE CONTACT POINT FOR BILLING QUESTIONS. 


*** PRIMARY ACCESS INFORMATION================================================== 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 

Page 51 of 929 


OFFICIAL USE ONLY 



REQUESTED BY: 


c 


(b)(6), (b)(7)(C) 


OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: | (b)(7)(E) | SUB RECORD 01 


*** IDENTIFYING INFORMATION ========== 

mamr ■ I IUJUJ. I* u.s.l. 5 juua(u) uiliu uiumi aim am wiuiyaayu i 

Id . | rinhts fhsnviw I I q I- K Prntertjnn a I 

*** DESCRIPTIVE INFORMATION ========== 

*** ADDRESS AND TELEPHONE INFORMATION; 
*** INFORMATION ON OFFICERS ========== 


*** OTHER INFORMATION =============================================== 


RECORD 


(b)(7) 


STATUS : 
AGENCY : 
TELEPHONE 
DATE ENTERED 


OWNERSHIP INFORMATION======== =========== 

PREVIOUS SUSPECT, CLOSED CASE 
I ICE OI HQ - CHIEF, CYBERSMUGGL NAME: T 
972 44 | wt 7A“ n/r l TITLE: 

“ 102406 LAST UPDATE: 022514 


DATE: 022514 


CASE NUMBER: | (b)(7)(E) | 

REMARKS * 

SUBJECT EMAIL ACCOU NT HAS PROVIDED A CCESS TO NUMEROUS MEMBER ONLY CP WEBSITES 
ASSOCIATED WITH THE 1. 2717 AT, I INVESTIGATION 


*** PRIMARY ACCESS INFORMATION================= 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 

Page 52 of 929 


OFFICIAL USE ONLY 



REQUESTED BY: 


c 


(b)(6), (b)(7)(C) 


□ 


OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 

TECS RECORD ID: I (b)(7)(E) | 


SUB RECORD 01 


*** IDENTIFYING INFORMATION ========== 

NAMF • I (B)(3)! 14 U.S.L. S jaua(O) Lniio victims ana eniia witnesses rignts,(B) | 

1 ' I HVH I I <? c K fFoHoial Prntoghnn unit Qinhtg A|^\ I 

*** DESCRIPTIVE INFORMATION ========== 

*** ADDRESS AND TELEPHONE INFORMATION; 
*** INFORMATION ON OFFICERS ========== 

*** OTHER INFORMATION ================ 


*** REC ORD O WNERSHIP INFORMATION ======== =======— 

STATUS: (b)(7) PREVIOUS SUSPECT, CLOSED CASE 
AGENCY; (E) ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: 
TELEPHONE: 972 44 |^7A ua,; I TITLE: 

DATE ENTERED: 102406 LAST UPDATE: 022514 


DATE: 022514 

1 (b)(6), (b)(7)(C) | 


CASE NUMBER: | (b)(7)(E) | 

REMARKS : 

SUBJECT WEBSITE IS THE PAYMENT WEBSITE LINKED TO NUMERO US COMMERCIAL CP 
WEBSITES BEING TARGETED AS PART OF THE gjgg %a£a 1 WEBSITE. 

*** PRIMARY ACCESS INFORMATION=== = = = = = = = = = = = = = ====== = === = = = = = = = ==-======; 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 

Page 53 of 929 


OFFICIAL USE ONLY 



REQUESTED BY : Q 


(b)(6), (b)(7)(C) 


□ 


OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT ' PAGE 1 

TECS RECORD ID: | (b)(7)(E) | SUB RECORD 01 


*** IDENTIFYING INFORMATION =================================== 

NAMF • I IBHJj: ia u.s.l. 5 jaua(O) cmia victims ana 1 

■ I rhilrt ™tn 0 Q<. 0 <.' rinhtQ fhOTV 1 S I I <3 =- K <W>1<1 I 

*** DESCRIPTIVE INFORMATION =================================== 

*** ADDRESS AND TELEPHONE INFORMATION^ ================= ======== 

*** INFORMATION ON OFFICERS =================================== 

*** OTHER INFORMATION ========================================= 


RECORD 


.OWNERSHIP IN FORMAT I ON = 


STATUS : 
AGENCY: Li! 
TELEPHONE 
DATE ENTERED 


(b)(7) IPREVIOUS SUSPECT, CLOSED CASE 
J2J ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: 
972 44 l wl 7A“*"l TITLE: 

102406 LAST UPDATE: 022514 


DATE: 022514 

| (b)(6), (b)(7)(C) | 


CASE NUMBER: | (b)(7)(E) | 

REMARKS : 

SUBJECT EMAIL LISTED IN REGISTRANT INFORMATION FOR THE DOMAIN NAME 
I ( 0 ) 1 37 18 u b L § jsuyiaj cnra mm i 


*** PRIMARY ACCESS INFORMATION============ 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 

Page 54 of 929 


OFFICIAL USE ONLY 



REQUESTED BY : | . ^>(6), (b)(7)(C) | 

OFFICIAL USE ONLY - - TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: | (b)(7)(E) | SUB RECORD 01 


*** IDENTIFYING INFORMATION ================= 

NAME • IIBJIJ)' i* u.b.L. s jaiMflj Lniia victims ana eniio witnesses i 

*** DESCRIPTIVE INFORMATION ================= 

*** ADDRESS AND TELEPHONE INFORMATION ======= 

*** INFORMATION ON OFFICERS ================= 

*** OTHER INFORMATION ======================= 


*** RECqRH 
STATUS 
AGENCY : 


OWNERSHIP I N FORMAT ION = = = = = 


(b)(7) 


PREVIOUS SUSPECT, CLOSED CASE 

| ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: 

TELEPHONE: 972 44 |^7A uA/, I TITLE: 

DATE ENTERED: 102406 LAST UPDATE: 022514 


CASE NUMBER: | (b)(7)(~ 


DATE: 022514 

| (b)(6), (b)(7)(C) \ 


REMARKS : 

THIS IS THE PRIMARY EMAIL ACCOUNT LINKED TO A PAYPAL ACCOUNT OWNED BY I'TiT-TI 
I '7^7 I . THIS PAYPAL ACCOUNT FACILIATED THE PAYMENT OF MEMBER ONLY CHILD PORN 
SUBSCRIPTIONS 

*** PRIMARY ACCESS INFORMATION=============================================== 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 

Page 55 of 929 


OFFICIAL USE ONLY 



REQUESTED BY : Q 


(b)(6), (b)(7)(C) 


□ 


OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 

TECS RECORD ID: I (b)(7)(E) | 


SUB RECORD 01 


*** IDENTIFYING INFORMATION ==================================================== 

NT AMP • I mi y 14 u.b.L. 5 J3uy(0) Lniia victims ana i 

IQ . | rhilri rinhtc Ih 1 R I I «i n K -WOO I 

*** DESCRIPTIVE INFORMATION ==================================================== 

*** ADDRESS AND TELEPHONE INFORMATION=========================================== 

*** INFORMATION ON OFFICERS ==================================================== 


*** OTHER INFORMATION =========================== 


*** RECORD OWNERSHIP INFORMATION 


STATUS: (b)(7) PREVIOUS SUSPECT, CLOSED CASE 
AGENCY: I ® \ ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: 
TELEPHONE: 972 44[^™^ TITLE: 

DATE ENTERED: 102406 LAST UPDATE: 022514 


CASE NUMBER: I (b)(7)(E~ 


DATE: 022514 

| (b)(6), (b)(7)(C) | 


REMARKS: 

SUBJECT EMAIL IS THE PRIMARY EMAIL ADDRESS FOR A PAYPAL ACCOUNT OWNED BY 
| (b)(6), (b)(7)(C) | . THIS PAYPAL ACCOUNT HAS FACILIATED CP PAYMENTS. 

*** PRIMARY ACCESS INFORMATION=========================================== 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 

Page 56 of 929 


OFFICIAL USE ONLY 



REQUESTED BY : | (b)(6), (b)(7)(C) 


OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 

TECS RECORD ID: I (b)(7)(E) | 


SUB RECORD 01 


*** IDENTIFYING INFORMATION ==================================================== 

NAMF • 

rU-U IE. . | ,-hilrt rinhh, 1« I I <? f~ K Vj(H> I 

*** DESCRIPTIVE INFORMATION ==================================================== 

*** ADDRESS AND TELEPHONE INFORMATION==== =========================== ============ 

*** INFORMATION ON OFFICERS ==================================================== 

*** OTHER INFORMATION ========================================-================= 


*** RECORD 


OWNERSHIP INFORMATIONS 


STATUS: (b)(7) PREVIOUS SUSPECT, CLOSED CASE 
AGENCY: ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: 

TELEPHONE: 972 44 T un 7A UA ''l TITLE; 

DATE ENTERED: 102406 LAST UPDATE: 022514 


DATE; 022514 

| (b)(6), (b)(7)(C) | 


CASE NUMBER: | (b)(7)(E) | 

REMARKS : 

SUBJECT EMAIL IS THE PRIMARY EMAIL ADDRESS FOR A PAYPAL ACCOUNT OWNED BY 
I (b)(6), (b)(7)(C) | . THIS PAYPAL ACCOUNT HAS FACILIATED CP PAYMENTS. 


*** PRIMARY ACCESS INFORMATION = 
LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 

Page 57 of 929 


OFFICIAL USE ONLY 



(b)(6), (b)(7)(C) 1 


REQUESTED BY : [ 

OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: | (b)(7)(E) | SUB RECORD 01 


NAME: [ 


IDENTIFYING INFORMATION 
(D)IJ)! 14 u.b.L. 5 jsua(a) Lnua warns sna i 

-hilrt rinhtc fhWqV 1 S I I Q C K ^QC. I 


*** DESCRIPTIVE INFORMATION 


*** ADDRESS AND TELEPHONE INFORMATION======; 


*** INFORMATION ON OFFICERS ==================================================== 


*** OTHER INFORMATION == 


*** RECORD. 


.OWNERSHIP INFORMATION===== 


STATUS: (b)(7) [PREVIOUS SUSPECT, CLOSED CASE 
AGENCY: I (E> I ICE 01 - BIRMINGHAM AL 
TELEPHONE: 205 29 1 TITLE: 

DATE ENTERED: 060107 LAST UPDATE: 101508 


NAME: □ 


DATE: 101508 


CASE NUMBER: | (b)(7)(E) | 

REMARKS : 

EMAIL ACCOUNT RELATED TO A SUBJECT WHO IS ALLEDGEDLY COLLECTING PAYMENTS FOR 
USER ACCESS TO A WEBSITE CONTAINING HUNDREDS OF IMAGES OF CHILD PORNOGRAPHY. 


*** PRIMARY ACCESS INFORMATION == = ; 
LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 

Page 58 of 929 


OFFICIAL USE ONLY 



REQUESTED BY : Q 


□ 


OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: I (b)(7)(E) | • SUB RECORD 02 


*** IDENTIFYING INFORMATION 


fhVtVIB I I «=! I— KISnQl 


DESCRIPTIVE INFORMATION 


ADDRESS AND TELEPHONE INFORMATIONS 


*** INFORMATION ON OFFICERS = 
*** OTHER INFORMATION ======= 


RECORD 


STATUS 
AGENCY : 


OWNERSHIP INFORMATION* 


(b)(7) PREVIOUS SUSPECT, CLOSED CASE 
® I ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: T 
TELEPHONE: 972 44 | wt 7A" A>, j TITLE: 

DATE ENTERED: 102406 LAST UPDATE: 022514 

CASE NUMBER: I (b)(7)( 


DATE: 022514 


□ 


REMARKS : 

SUBJECT EMAIL IS THE PRIMARY EMAIL ASSOCIATED WITH A PAYPAL ACCOUNT OWNED BY 
| (b)(6), (b)(7)(C) | . THIS PAYPAL ACCOUNT HAS ACCEPTED CP PAYMENTS 

*** PRIMARY ACCESS INFORMATION=============================================== 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 

Page 59 of 929 


OFFICIAL USE ONLY 



REQUESTED BY : | (b)( 6 ), (b)(7)(C) ~\ 

OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: I (b)(7)(E) | SUB RECORD 01 

*** IDENTIFYING INFORMATION ==================================================== 

NAME • I l“JW- 1* u 5 juuaiuj umu mm unu i 

1N/U I C . | oh iH rinhtc I hS A V 1 « I I «? C F RHnQ I 

*** DESCRIPTIVE INFORMATION ==================================================== 

*** ADDRESS AND TELEPHONE INFORMATION=========================================== 

*** INFORMATION ON OFFICERS ========================== = = = = = = =====.-============== 


*** OTHER INFORMATION = = === 


*** RECO 
STATUS : 

RD OWNERSHIP INFORMATION= ==== 

(b)(7) PREVIOUS SUSPECT, CLOSED CASE 


DATE: 092211 

AGENCY : 

(E| ICE OI - BIRMINGHAM AL 

NAME: Q 

(b)(6), (b)(7)(C) | 

TELEPHONE: 205 2 9l | TITLE: 

DATE ENTERED: 042307 LAST UPDATE: 092211 




CASE NUMBER: | (b)(7)(E) | 

REMARKS : 

SUBJECT WEBSITE IS A COMMERCIAL CP WEBSITE LINKED TO THE CURRENT INVESTIGATION 
THROUGH IDENTICAL PAYMENT METHODS (PAYPAL ACCOUNTS) 

*** PRIMARY ACCESS INFORMATION================================================ : 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 

Page 60 of 929 


OFFICIAL USE ONLY 



REQUESTED BY : Q 


(b)(6), (b)(7)(C) 


OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 

TECS RECORD ID: | (b)(7)(E) | 


SUB RECORD 02 


*** IDENTIFYING INFORMATION 
NAME • I mw 14 u.s.L. «, J31M0) Lniia victims ana i 
Wi4i m ■ I child aiilaeaaaa aablaJbkkl&lLSJ: SjaoaJ 

*** DESCRIPTIVE INFORMATION 


*** ADDRESS AND TELEPHONE INFORMATION: 


*** INFORMATION ON OFFICERS 


*** OTHER INFORMATION 


REC ORD O WNERSHIP INFORMATIONS = 


STATUS: (b)(7) PREVIOUS SUSPECT, CLOSED CASE 
AGENCY: I ® I ICE 01 HQ - CHIEF, CYBERSMUGGL NAME; 
TELEPHONE; 972 44 |^7A U ~'M TITLE: 

DATE ENTERED: 012407 LAST UPDATE: 022514 


DATE: 022514 

| (b)(6), (b)(7)(C) | 


CASE NUMBER: | (b)(7)(E) | 

REMARKS : 

SUBJECT WEBSITE IS A MEMBER ONLY CP WEBSITE 


*** PRIMARY ACCESS INFORMATION================================================== 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 

Page 61 of 929 


OFFICIAL USE ONLY 



REQUESTED BY: 


C 


(b)(6), (b)(7)(C) 


OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 

TECS RECORD ID: | (b)(7)(E) | 


SUB RECORD 01 


*** IDENTIFYING INFORMATION ==================================================== 

NAME • I IUJUJ- 1* u.s.l. 4 juimuj lhiiu mm am i 

VUV ‘ ID . | rhllri .itn.....' rinh t » fhWTl- IB HIP H -WIWHS I 

*** DESCRIPTIVE INFORMATION ==================================================== 

*** ADDRESS AND TELEPHONE INFORMATION=========================================== 

*** INFORMATION ON OFFICERS ==================================================== 


*** OTHER INFORMATION ================== 


*** REC ORD O WNERSHIP INFORMATION========= 

STATUS: (b)(7) PREVIOUS SUSPECT, CLOSED CASE 
AGENCY: ( *> ICE 01 BI RMINGHAM AL 

TELEPHONE: 205 2 9 l lUA " , A" w,, l TITLE: 

DATE ENTERED: 042307 LAST UPDATE: 092211 


DATE : 092211 

NAME: | (b)(6), (b)(7)(C) | 


CASE NUMBER: | (b)(7)(E) ] 

REMARKS : 

SUBJECT IS A MEMBERS ONLY WEBSITE ALSO KNOWN AS l„, J OFFERING 
ACCESS TO CHILD PORNOGRAPHY, 


*** PRIMARY ACCESS INFORMATION=========; 

LOOKOUT LEVEL; 


OFFICIAL USE ONLY 


TECS II INFORMATION 

Page 62 of 929 


OFFICIAL USE ONLY 





*** REC ORD O WNERSHIP INFORMATION ========== ====== 

STATUS: |(b)(7)|PREVIOUS SUSPECT, CLOSED CASE 
AGENCY: I (E> I ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: 
TELEPHONE: 972 44 | W ^/A UA ''I TITLE: 

DATE ENTERED: 012407 LAST UPDATE: 022514 


DATE: 


022514 


CASE NUMBER: 


REMARKS : 

THIS IS A SUBJECT IDENTIFIER USED BY VARIOUS PAYPAL ACCOUNTS THAT HAVE 
FACILIATED THE SALE OF CP VIA NUMEROUS ADVERTISING AND MEMBER ONLY WEBSITES. 


*** PRIMARY ACCESS INFORMATION=========== 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 

Page 63 of 929 


OFFICIAL USE ONLY 



(b)(6), (b)(7)(C) 


REQUESTED BY: [ 

OFFICIAL USE ONLY -- TECS II INFORMATION - - OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: | (b)(7)(E) | SUB RECORD 01 

*** IDENTIFYING INFORMATION ==================================================== 

NAMF • I Ifl U.S.L. 5 J3uy(fl) umia warns ana emia witnesses i 

' I rinhtc fhWIVIB I I <? C R <WnQM\ Mr hm c ' Prntortinn I 

*** DESCRIPTIVE INFORMATION ==================================================== 

*** ADDRESS AND TELEPHONE INFORMATION============= ======================== ====== 

*** INFORMATION ON OFFICERS ==================================================== 

*** OTHER INFORMATION ========================================================== 

*** REC ORD O WNERSHIP INFORMATION================================================ 

STATUS: [^PREVIOUS SUSPECT, CLOSED CASE DATE; 022514 

AGENCY: I ® I ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: | (b>(S>,(b>(7>(C> | 

TELEPHONE: 972 44 1 TITLE: 

DATE ENTERED; 012407 LAST UPDATE: 022514 

CASE NUMBER: | (b)(7)(E) | 

REMARKS : 

SUBJECT WEBSITE IS A MEMBER RESTRICTED CP WEBSITE KNOWN AS L.A'A' I - 

*** PRIMARY ACCESS INFORMATION================================================== 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 


Page 64 of 929 



REQUESTED BY : Q 


(b)(6), (b)(7)(C) 


OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 

TECS RECORD ID; | (b)(7)(E) | 


SUB RECORD 01 


*** IDENTIFYING INFORMATION ===================== 

NAMF • I 14 u.s,.l. 5 jauaiaj cniia victims ana i 

■ I rhilH rinhtc fhUSV IgllSf K “WHO I 

*** DESCRIPTIVE INFORMATION ===================== 

*** ADDRESS AND TELEPHONE INFORMATION =========== 

*** INFORMATION ON OFFICERS ===================== 

** * OTHER INFORMATION =========================== 


** RECORD 


.OWNERSHIP INFORMATION ====== 


STATUS: (b)(7) PREVIOUS SUSPECT, CLOSED CASE 
AGENCY: (E) ICE 01 HQ CHIEF, CYBERSMUGGL NAME: 

TELEPHONE: 972 44 r u *7A u *''l TITLE: 

DATE ENTERED: 013107 LAST UPDATE; 022514 


CASE NUMBER: | (b)(7)(~ 


DATE: 022514 

| (b)(6)(b)(7)(C) | 


REMARKS : 

SUBJECT IS A BUSINESS NAME UTILIZED BY VARIOUS PAYPAL ACCOUNT LINKED TO 
PROJECT FLICKER 


*** PRIMARY ACCESS INFORMATION===- 
LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 

Page 65 of 929 


OFFICIAL USE ONLY 



REQUESTED BY : | (b>(6>,(b>(7>(c> | 


OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: | (b)(7)(E) | SUB RECORD 01 


*** IDENTIFYING INFORMATION ========== 

NAME: 

*** DESCRIPTIVE INFORMATION ========== 

*** ADDRESS AND TELEPHONE INFORMATION; 
*** INFORMATION ON OFFICERS ========== 


*** OTHER INFORMATION ============ 


*** RECORD OWNERSHIP INFORMATION================== 

STATUS: (b)(7) PREVIOUS SUSPECT, CLOSED CASE 
AGENCY: J5L ICE OI HQ - CHIEF, CYBERSMUGGL NAME: 
TELEPHONE: 972 44 T A 7A UA "I TITLE: 

DATE ENTERED: 121907 LAST UPDATE: 022514 


CASE NUMBER; | (b)(7 )( E~ 


DATE: 022514 

| (b)(6), (b)(7)(C) | 


REMARKS : 

SUBJECT IS A MERCHANT THAT IS KNOWN TO PROCESS PAYMENT FOR COMMERCIAL CHILD 
EXPLOITATION WEBSITES. 


*** PRIMARY ACCESS INFORMATION================= 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 

Page 66 of 929 


OFFICIAL USE ONLY 



REQUESTED BY : | (b)(6), (b)(7)(C) | 

OFFICIAL USE ONLY 


DEPARTMENT OF HOMELAND SECURITY 
ICE 


REPORT OF INVESTIGATION 


TECS ACCESS CODE |(bin 


CASE “NUMBER \_ 


TITLE.. COMMERICAL CP WEBSITE KNOWN AS | ™ ^ ™ 1 


CASE STATUS: 

INTERIM RPT 



REPORT DATE 
052306 

DATE ASSIGNED 
051706 

PROGRAM CODE 

REPORT NO. 
001 

RELATED CASE NUMBERS: 




COLLATERAL REQ : 


TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 


TOPIC: IDENTIFICATION OF A MEMBER ONLY CP WEBS ITE~- T..g^yi.u^.^5 


SYNOPSIS: 

On April 5, 2006, Senior Special Agent (SS/A) | (b>(6> (b>(7>(o | . Immigration and 

Customs Enforcement (ICE), Cyber Crimes Center (C3) , Child Exploitation 
Section (CES) , received information from the National Center for Missing and 

child 


Exploited Children (NCMEC) regardi ng a co mmercial website offering 
pornoqraphy for sale via cybertio I (b)(7)(E) I. The reported URL was 

r (b)(3): I tffl b l ^ jbtiil(d) Un l d victims and chi l d I which known 3S "I !“)(■» m 1 

LitQaaam.m^ wnicn was Known as 


u- 


This report details an undercover purchase at URL: °, n u h ° 'r h ^p l 

The purchase provided access to a commercial child pornographic member site 

known as " 


DISTRIBUTION; 

SIGNATURE: 

| (b)(7)(E) | 

| (b)(6), (b)(7)(C) | SENIOR SPEC AGENT 



APPROVED : 

I (b)(6), (b>(7>(C> | ASST DIRECTOR (01) 

ORIGIN OFFICE: KS 
HQ - CHIEF, CYBER CR 

TELEPHONE: 703 29I'“''7A“ A "I 

TYPIST 
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ICE 


R T OF 
C O N T 


I N V 
I N U . 


STIGATION 
T I O N 


CASE NUMBER □ 


REPORT NUMBER: 001 


DETAILS OF INVESTIGATION 


3 Immigration and 


On April 5, 2006, Senior Special Agent (SS/A) | (b)(5), (b)(7)(C) 

Customs Enforcement (ICE) , Cyber Crimes Center (C3) , Child Exploitation 
Section (CES) , received information from the National Center for Missing and 
Exploited Children (NCMEC) regardi ng a co mmercial website offering child 
pornography for sale via cybertip I (b)(7)(E) I. The reported URL was 

r (b)(3): I STI.S.U.T, aitiyta) Uh.ia V, dims' and Chlia I wh -j~ h w -,c. a-’ „| HDli ? 1 6 ' JbL t, mom I r. 

(witnesses' rinhh. fhwsvm II s n s s marm tFederei v/, l WblCh WaS Known ao |,- |h| | |1 yiftim ; nnrirhilriMtnpl' 


On the same date, S S/A acc essed URL 

page was entitled "L “ * — ''“r” rh""’ “t u 


5i3UdlH]Ln 






3 This web 


The title bar 
J (updated 16.03.06) Real 
It should be 


reflected the name of the web page as lMW MM 

Children Porno Pay Site! Child Fuck! Absolutely Illegal!!! 
noted t hat this advertisi ng website was the same advertisi ng website acces sed 
by SS/A | (b)(6), (b)(7)(C) | at the onset of Project Watchdog ( I (b)(7)(E) 

the website was hosted at a different URL when accessed by SS/A |(b>(6>,(b>(7>(c> | . 


to other web pages . The 

links were "ABOUT SECURITY", "JOIN NOW" and "FREE PREVIEW". The following 
statements were made on the initial web page: 


"Now in Members Zone" 

"600 MB of Photos" 

"234 Exclusive Gallery" 

"6 Gigabytes of Video" 

"205 porno TEXTS & FORUM!" 
"2006 Year Updated!!!" 
"with exclusive content" 


"No Fakes" 

"2-12 y.o. Girls and Boys in video, photo, text content without any censure!" 
"ABSOLUTELY ILLEGAL" 

"REAL" 

"Hardcore Fuck of Little Girls, Brutal Rapes, Sweet Love - all that you can 
wont - HERE!" _______ 

"FUCK the FBI! is time approved site. Working since 2000 year and no 

one of the users haven't any troubles with law, because on this site you have 
guaranteed 100% privacy and security from Trojans and any FBI spies." 


In addition, the 
the Internet URL 

approximately twenty- 
1 (bxjt 1 a u.s.u § jsuyifl) Lhiio victims snow 


K IFpilpf.il VirtiiiTi' Prntprtinn nr 


U.S.C. § 3509(d) Child 
U.S.C. § 3509(d) Child 


3 Several of the images depict 


ses rights (b)(3): 1 8 U.S.C- § 3509(d) (Federal Victim; 
s' rights,(b)(3):18 U.S.C. § 3509(d) (Federal Victims' Protection 


J! This page 
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CASE NUMBER | (WKE) “I 

REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: 001 


stated the following: 


"There are NO FAKES, only real Children porno, all content with models at 2 
years old" 

"There are NO TEENS, only real little kids porno here! >" 

"There are NO PROBLEMS with privacy, we don't store any information about 
users I " 

"Big update in memberzone l " 

"Now you can enjoy 612Mb of photo in 234 Exclusive Galleries, view over 6 
GIGABYTES of VIDEO, read more then 200 porno texts. During update was 
replaced by exclusive fresh content 205Mb of photos, and 4Gb of cp video!" 


(b)(3): 1 


child witnesses' rights, (b)(3): 18 U.S.C. § 3509(d) (Federal Victims' Protection and Rights Act), (b)(6), (b)(7)(C), (b)(7)(E) 



10 1. Excerpts of the text on that page 


included: 


"CONGRATULATIONS ! " 

"Congratulations, you are one step over the biggest archive of child porno 
photos and movies. Our price is too high, because we pay big money to host 
this illegal site. But we promise our member section won't be delete 
thousands times like other ones!" 


"We protect our clients from all troubles with police and law!" 


"1 month membership for only $79.95!" 

"To get access to CP site pay membership then you will get passwords to CP 
member zone via e-mail" 

"accepted all credit cards" 


The above text "1 month membership" was a hyperlink which redirected to 
| ww I . This webpage contained a form entitled 
"User Info," which required the customer to enter their name, e-mail, 
address, telephone, and credit card information. In addition, the form 

password. The webpage also 
,nna victims ana auia nr 


requested the customer to select a logi n and^ga 
contained a button labeled "Continue." 


(b)(3): 1 8 U.S.C. § 3509(d) Cl 


: rights,(b)(3):18 U.S.C. § 3509(d) (Federal Victims' Protection and Rights Act), (b)(6), (b)(7)(C), (b)(7)(E) 


from the webpage: 
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CASE NUMBER | (b>(7>(E> T 

REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: 001 


"Thank you [ Your transaction has been completed. Your account will be 
approved in 24 hours and you'll get an e-mail confirmation." 


On April 6, 2006, SS/A F t %>7A tl, l received an e-mail messa ge from 
| (b)(6), (b)(7)(c) I sgmail . com . The subject line was 11 ! ! YOUR ACCOUNT. 11 The 

following text was excerpted from the e-mail: 

"Congratulations! " 


"Your subscripti on wan successfully finished;" 
"MemberZone url • I 'l.’i’sj TTOST 5 350 ! 3 - a an - 3 wSieSles • gFS L 

" login * (bliai - iau - s - c - ^ a5Q81dHFede[fll.Yiaims' Piafficttan and Rights Attl 




S3" 


"password: 

" En j oy ! " 

"Important notification!" 


"We save all your connections with members zone, and protect this 
information. But we don't allow to login different users with your login and 
password. Please, be careful and don't give to anybody your password! 

Please, write to support on this mail with any problems and questions." 

On or about the same date, SS/A | b> s> bjj wwi > | 

that provided, among other things] registrant information and hosting 
information for a given URL. The database search provided the following 
information: 


I (B)(3) ! I B u.b.L . 5 jsuma) Lm i a 1 

Imi-tim-; nnrl rhiltl ■•■iiHnj' i-nP i nnhh Ih)i3l 

Organisation Name:| m 

Organisati on Address :|_ 
IP Address: ! ms) (b)(7)(c) 


3 Emeryville, 


OrgName ^AltaVista Comp any 

Address: ! (b)(6) (b)(7)(c) | , Sunnyvale, CA. 94089 


CA. 94662 


| (B)(3)! IB U bL^^J3Uy(B) LW VIOTW5 SM^CnilB | 

Registrant” Name T Q ' HWF °bMG) (b)(7)(G) I 

Registrant Address: ! (b)(6) (b)(7)(C) J, NY , NY 12345 
Registrant Telep hone : + 001 ■ 415123 1 
Registrant Email :l (b)(6) (b)(7)(C) | @yahoo .co.uk 
IP Address: ! (b)(G> (b)(7xo> | 

OrgName : Kennel Accountants, Financial Services 

Address: ! I Bundaberg, OLD 4670 AU 

OrgTechName :| (b)(6), (b)(7)(C) | 

OrgTechPhone : +61 - 73-3 I I [U ‘^ ! I 
OrgTechEmail -.[S3@ls-partner.net 
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S T I G A T 
T I O N 


CASE NUMBER £ 


REPORT NUMBER: 001 


c 


On April 6, 2006 ZE 


T 


(b)(6), (b)(7)(C), (b)(7)(E) | 

It appears that the amount listed on the 

advertising website was not the actual amount charged. The individual 
operating this website may have stolen the content from the original 
individuals that operated {and continue to operate) the advertising websites 
associated with Project Watchdog). No other related transactions have been 
charged . 


(b)(6). (b)(7)(C). (b)(7)(E) 


SS/A 

|WW!T8 




(b)(6), (b)(7)(C), (b)(7)(E) 

- T he website was entitled "[ 




-.'5 JSU9(B) U 


a - 


Secret Members area." There were 19 galleries under the hyperlink 
"Softcore;" 17 galleries under the hyperlink "Hardcore,-" and 3 galleries 
(Chil d Porn, Lo-Video, and Young Bang) under the hyperlink "Video." SS/A 
l * 1 ° 7 »rs° ) l was unable to capture the complete website; the following was captured: 
all 19 "Softcore" galleries (containing approximately 2400 image files 
depicting prepubescent males and females engaged in sexually explicit 
conduct) ; one of the "Hardcore" galleries (contained approximately 400 image 
files depicting prepubescent males and females engaged in sexually explicit 
conduct) ; and approximately 630 video files from the "Child Porn" video 
gallery. 

On May 16, 2006, SS/A | ( ° ) 7 ( f, l r 1 ° ) | issued Customs summons and preservation letters to: 
Yahoo! f or the URL 1 1": 


raiairl) Child vim I - -------- ■ .... 

Google for the e-mail account 


^]@gmail. com 


On or about the same date, SS/A contacted \~ rnGuvaxc, | , Australian 

Federal Police, for assistance in obtaining the content located at URL 

I (b)(3): l i) U.S.U. ^ 3bUy(d) Chi l d victims 1 and chi l d wtnesses 1 nghts, I 

I (h)(3)' 1H 1 1 S f. ii^rinfl(iiwFpilprfilVirlimVPrnlprliiiiinnilRinhl-i I' 


On May 18, 2006, Yahoo provided the following details related to Yaho e-mail 
account ahoo .co.uk: 

Login Name : Hb)(s) (b)(7)ic> | 

Properties Used: Mail 

Registration IP: I (b>(G> (b)(7)(C) | 

Full Name: Mr. | (bxs) (b)(7>ic) | 

Country : Bolivia 
Zip/Postal Code .-4 5786 

Account Created :Tue Mar 7 08:06:08 2006 


In addition, Yahoo provided the following login IP information: 

| (b)(6), (b)(7)(C) | Sat 2006-04-0121 :56;40GMT 
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CONTINUATION 

REPORT NUMBER: 001 

(b)(6), (b)(7)(C) 

Sun 2006-04-0213 :13:42GMT 
Sun 2006-04 -0221: 07 :12GMT 


(b)(6), (b)(7)(C) 

on 2006-04-0312:52: 18GMT 
on 2006-04-0314:22: 22GMT 


(b)(6), (b)(7)(C) 

Mon 2006-04-0316: 58 :01GMT 
Mon 2006-04-0317 :5S:39GMT 
Mon 2006-04 -0320: 17 :53GMT 


(b)(6), (b)(7)(C) 

Wed 2006-04-0512:59 : 30GMT 
Thu 2006-04-0612 : 52 :26GMT 
Thu 2006-04-0614 : 51: 04GMT 
Fri 2006-04-0716:20: 57GMT 


(b)(6), (b)(7)(C) [f- 

on 2006-04-1014: 04 :52GMT 


(b)(6), (b)(7)(C) 

Mon 2006-04-1023 :40:15GMT 
Tue 2006-04-1817 :24:31GMT 
Tue 2006-04-1818:11: 37GMT 
Tue 2006-04-1818:11: 59GMT 


(b)(6), (b)(7)(C) 

ue 2006-04-1823 :23 :11GMT 
ed 2006-04-1914:24: 05GMT 



Investigation continues. 
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REPORT OF INVESTIGATION 


TITLE: COMMERICAL CP WEBSITE KNOWN 


TECS ACCESS CODECS 


PAGE 1 

CASE NUMBER I (b)(7)(E) f 


CASE STATUS; 

INTERIM RPT 



REPORT DATE 

DATE ASSIGNED 

PROGRAM CODE 

REPORT NO. 

062606 

051706 

ra 

, 002 


RELATED CASE NUMBERS:" 


COLLATERAL REQ: 


TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 


TOPIC: REQUEST FOR NCMEC CRIS ANALYSIS OF A CHILD PORN MEMBER WEBSITE 


Senior Special Agent (SS/A) Q 


3 Immigration and 


SYNOPSIS: 

On April 5, 2006, _ _ 

Customs Enforcement (ICE) , Cyber Crimes Center (C3) , Child Exploitation 
Section (CES) , received information from the National Center for Missing and 
Exploited Children (NCMEC) regarding a commercial website offering child 
pornography for sale via cyber tip I (b)(7)(E) i . The repo rted URL was 


n imnv m i i s n r flRnnrriuEfldaMi. 


which was known as "Ej 




This report serves as a request to the National Center for Missing and 
Exploited Children (NCMEC) to have images captured from a commercial child 
pornography website reviewed against the Child Recognition Identification 
System (CRIS) . 


DISTRIBUTION: 

SIGNATURE: 

| (b)(7)(E) | 

| (b)(6), (b)(7)(C) | SENIOR SPEC AGENT 



APPROVED : 

I (b)(6), (b)(7)(C) 1 ASST DIRECTOR (OI) 

ORIGIN OFFICE: KS 
HQ - CHIEF, CYBER CR 

TELEPHONE: 7 03 29I'“''7A U, '"I 

TYPIST: 
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REPORT NUMBER: 002 


CASE PROGRAM CODES: 


(b)(7)(E) 
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CASE NUMBERl (b)(7)(E) | 

REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: 002 


DETAILS OF INVESTIGATION ' 


On April 5, 2006, Senior Special Agent (SS/A) ^ 


3 Immigration and 


Customs Enforcement (ICE) , Cyber Crimes Center (C3) , Child Exploitation 
Section (CES) , received information from the National Center for Missing and 
Exploited Children (NCMEC) regardi ng a co mmercial website offering child 
pornoqraphv for sale via cybertip I (b)(7)(E) |. The reported URL was 

I IbJUJ. IBTJ b, lA JbUyid) Lhild victims and chid I which was knoW n 3S "I 
lwftn aMa9 ‘ rinhfs 1 S I I S H S SROflM' rFpHp,»l V. I. WniCH WSS KHOWU aS | rh , hi , irlimt 




On April 6, 2006, SS/A F%“/A u, l received an e-mail messa ge f rom 
| (b)(6), (b)(7)(c) l @qmail.com. The subject line was 11 ! iYOUR ACCOUNT. " 









Secret Members area." There were 19 galleries under the hyperlink 
"Softcore/" 17 galleries under the hyperlink "Hardcore; " and 3 galleries 
(Chil d Porn, Lo-Video, and Young Bang) under the hyperlink "Video." SS/A 

was unable to capture the complete website; the following was captured: 
"Softcore" qalleries 1 throuqh 6 (containing approximately 900 imaqe files 

ffyu. ^ Ubuy(d) Uhlid victims' ant) Stild wffnlises 1 i‘igh(s, (b)(3)! 1 8 iTbi.L I, Jbliy(d) (hedSi’ftl I 

VirtimV Pmlerlinn nnil Rinhli t I, 

es 1 and 2 (containing approximately 115 imaqe 
j ' t; 1 ! ' -."v. ’ v I'j.i y. . . i b) , 'f M, >, ,fflii!nn) 11 wffr.n | 

liJ^^iL,! ) ; and approximately 300 video files from the "Child Porn" video 
gallery. PLEASE NOTE THIS IS A CORRECTION TO ROI# 001, WHICH STATED 
ADDITIONAL IMAGES WERE CAPTURED. 


depicti ng prepubescent '° 
; "Hardcore" galleri 
f i 1 e s depicting prepubescent 


C3/CES requests that the provided image files be run against the NCMEC Child 
Recognition Identification System (CRIS) . The password for the zip file is 
" I (b>(7)(E> " Any new inform ation developed related to the victims 

should be forwarded to SS/A r,"»A u 1 : 


Senior Special Agent | (b)(6), (b)(7)(C) | 

ICE/C3/CES 

I (b)(G>,(b)(7)(C> 1 

Fairfax, VA 22030 
(703) 2 

| (b)(G),(b)(7>(C) | 


Investigation continues. 
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TECS ACCESS CODE~~['J" 


PAGE 1 

CASE "NUMBER | (b)(7)(E) ~ T 


"tItLeT" COMMERICAL CP WEBSITE KNOWN AS 


CASE STATUS: 

INTERIM RPT 



REPORT DATE 
070306 

DATE ASSIGNED 
051706 

1 

PROGRAM CODE 

m 

REPORT NO. 
003 


RELATED CASE NUMBERS: 


COLLATERAL REQ: 


TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 

i 




SYNOPSIS: 

On April 5, 2006, Senior Special Agent (SS/A) Q 


3 Immigration and 


Customs Enforcement (ICE) , Cyber Crimes Center (C3) , Child Exploitation 
Section (CES) , received information from the National Center for Missing and 
Exploited Children (NCMEC) regardi ng a co mmercial website offering child 
pornography for sale via cybertip I (b)(7)(E) | . The reported URL wa 
I -'..I wh!>h wsc. knnwn « "I WWmuJi 8JJUJW I „ 


[ 

website was known 


which was kn own as "E 

la u.SL. 5 3 bu»(d) uniia 1 11 

uiaima..aal.f.Md. ailnfiaata .iinhial ’ 


3 • " The member only 







DISTRIBUTION: 


| (b)(7K E > | 

| (b)(6>, (b)(7)(C) | SENIOR SPEC AGENT 



APPROVED : 

I (b)(6), (b)(7)(C) I ASST DIRECTOR (OI) 

ORIGIN OFFICE: KS 
HQ - CHIEF, CYBER CR 

TELEPHONE: 7 03 29I VW 5MT"I 

TYPIST : l l “S‘" , l 
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"Now in Members Zone" 

"600 MB of Photos" 

"234 Exclusive Gallery" 

"6 Gigabytes of Video" 

"205 porno TEXTS & FORUM!" 
"2006 Year Updated!!]" 
"with exclusive content" 


"No Fakes" 

"2-12 y.o. Girls and Boys in video, photo, text content without any censure!" 
"ABSOLUTELY ILLEGAL" 

"REAL" 

"Hardcore Fuck of Little Girls, Brutal Rapes, Sweet Love all that you can 
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CASE NUMBER 1 (bimti) | 

REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER ? 003 


wont HERE ! 


"FUCK the FBI! is time approved site. Working since 2000 year and no 

one of the users haven't any troubles with law, because on this site you have 
guaranteed 100% privacy and security from Trojans and any FBI spies." 


In addition, the link to the "FREE : PREVIEW " displayed a web page located at 
the Internet URL *1 'usnS; ° l> " whic h displayed 
approximately twenty-five (25) imaqes . The images depicted uy . 

| "(B)(3): 18 U.S.U. § 3bU9(d) Child victims' and child witnesses' rights. (b)(3): I e ' - - “ 




" s 3SI19M1 IFprlprnl Victims' Protection nnrt Rinhte Art' 


U.S.C. § 3509(d) Child 


Several of the images depict 


a 


1 rights, (b)(3): 1 8 U.S.C. § 3509(d) (Federal Vi 


S.C. § 3509(d) Child victi 


witnesses' rights,(b)(3):18 U.S.C. § 3509(d) (Federal Victims' Protection e 


stated the following: 


Rights Act) 
id Rights Act) |. 


This page 


"There are NO FAKES, only real Children porno, all content with models at 2 
years old" 

"There are NO TEENS, only real little kids porno here!!" 

"There are NO PROBLEMS with privacy, we don't store any information about 
users! " 


"Big update in memberzone!" 

"Now you can enjoy 612Mb of photo in 234 Exclusive Galleries, view over 6 
GIGABYTES of VIDEO, read more then 200 porno texts. During update was 
replaced by exclusive fresh content 205Mb of photos, and 4Gb of cp video! 


(b)(3): 18 U.S.C. § 3509(d) Child victims' a 


ild witnesses' rights, (b)(3): 18 U.S.C. § 3509(d) (Federal Victims' Protection and Rights Act), (b)(3), (b)(7)(C), (b)(7)(E) 


(b)(3): I D U S U ^ 3bU3(d) Uh ' ild vidims 1 and chi l d w.lness ' es 1 nghls (b)(3) 1 8 

)l ft T. S asnairi) IFRriRffll VirJimn' PrnlRrJinn and Rinhla Ata) 


J! Excerpts of the text on that page 


"CONGRATULATIONS ! " 

"Congratulations, you are one step over the biggest archive of child porno 
photos and movies. Our price is too high, because we pay big money to host 
this illegal site. But we promise our member section won't be delete thousands 
times like other ones!" 

"We protect our clients from all troubles with police and law!" 

"1 month membership for only $79.95!" 

"To get access to CP site pay membership then you will get passwords to CP 
member zone via e-mail" 

"accepted all credit cards" 

The above text "1 month membership" was a hyperlink which redirected to 
| ww 10 u % g J n Q u ,T,£^ I • This webpage contained a form entitled 
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their name, e-mail, address, telephone, and credit card information. In 
addition, the form requested the customer to select a login and password, 
'ebpage also contained a button labeled "Continue." I (b)(7)(E) | 


(b)(6). (b)(7)(C), (b)(7)(E) | 

and child witnesses rights (b)(J) IB U S> L !j JbUy(d) I f n 1 1 nW i na F^Vt ^ pvfpm hpH 

/ppHorai — h pinh,. I- rne toi lowing text was excerpted 

from the webpage: 


TBWre 


j. ^ abuy(d) child 


"We can't approve you billing information with out primary payment processor 
online. In nearest time you'll get e-mail with instructions how to finish." 


On Jun 23, 2006, S S/A l'7)°'A u 1 received an e-mail message from 

| (b)(6), (b)(7)(c) | ®yahoo.com. The subject line was "Your order confirmation." 

The following text was excerpted from the e-mail: 


"Recently you made request to join elite child porno paysite. 

"You've just went through verification step." 

"Your credit card wasn't charged." 

"You are in one step from biggest child porno member zone." 
"To complete registration follow instructions." 


"To pay by credit card you need to follow these simply instructions: 


1. 

onen link: 1 


(b)(7)(E) 1' 

2 . 

enter your credit 

card info" 


3 . 

wait for login on 

your e-mail." 



"After that you will receive email with login info to our child porno site. 
Thank you for your patience." 

"WARNING! 1 ! For our and your security please email all questions only to this 
email ( | ms) (b)(7)(c) | @yahoo.com) . All emails that will be sent to other 

email addresses will be ignored." 


"IF YOU WANT AN ANSWER IN MOMENT FROM US PLEASE WRITE ANYTHING TO 
| (b)(6), (b)(7)(C) | @yahoo . com (fastest support)." 

"IF YOU WILL WRITE EMAILS TO ANOTHER ADDRESSES YOU WILL NOT RECEIVE ANSWERS! 
DON'T WR ITE ANYTHING ABOUT CP TO OTHER ADDRESSES. THIS IS FOR YOURS SECURITY. 
ONLY TO I (b)(6), (b)(7)(C) l Oyahoo . com . " 


(b)(3): 1 8 U.S.C. § 3509(d) Child victims' and child witnesses' rights, (b)(3): 18 U.S.C. § 3509(d) (Federal Victims' Protection and Rights Act),(b)(S),(b)(7)(C), (b)(7)(E) 
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payment webpage. The following text was excerpted from the webpage: 


"Pay To: 
" Payment 
"Amount : 


Financial Services, 

p I (b)(U): IB U.b> U ^ UbUy(d) Chile 

• ■ I victims' nnd child witnesses nnhl 

$79.95 USD" 


(BF) 

Full Version" 


The payment for the child pornography member only website known as ! °| 

I nhiiri I " was facilitated by Financial Services, (BF) , through PayPal's 
payment platform. 


On the same date, SS/A 


received an e-mail message 


CSSSS2^SSS]®yaho'^S , t i : ■ The subject line of the 


completed! 11 The following text was excerpted from the 


from 

e-mail was "Signup 
e-mail: •> 


is 


"Congratulations ! 


"Your subscripti on was successfully finished! 
"MemberZone url 
"login: R>» 

"password : f M iTOj 
"E njoy ! " 

"Important notification! " 


r KTT| n 


"We save all your connections with members zone, and protect this 
information. " 

"But we don't allow to login different users with your login and password." 
"Please, be careful and don't give to anybody your password!" 

"Please, write to support on this mailwith any problems and questions." 

" k avahoo .com" 


j (b)(6), (b)(7)(C), (b)(7)(E) | 

1 (b)(7)(E) |. 

The database search provided the following 

information: 



bnteruikel . com 



Organisation Name: 
Organisation Address: 
IP Address : 

(b)(6), (b)(7)(C) 

|, Mesa, AZ 85203 

OrgName : 

Inktomi Corporation 


Address : 

| (b)(6), (b)(7)(C) |, Sunnyvale, CA. 94 08 9 

1 (b)(3): 1 8 U.S.C. §3505 1 
members .lldl Child victims’ and chill . us 



Registrant Name: 

| (b)(6), (b)(7)(C) | 
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Registrant Address: 
Registrant Telephone: 
Registrant Email: 

IP Address : 

OrgName : 

Address : 

OrgTechName : 
OrgTechPhone ; 
OrgTechEmail : 


(b)(6), (b)(7)(C) 

+001 


□ , NY, 


NY 12345 


rep slis@yaho o .co.uk 

| (b)(6) (b)(7)(C) | 

Kennel Accountants , Financial Services 

(b)(6), (b)(7)(C) I. Bundaberg, OLD 4 670 AU 


(b)(6), (b)(7)(C) 


The member only website is currently hosted at Genes is2 Networks in Charlotte, 
North Carolina . 


(B)(3)! 18 U.y.L. &35Uy(fl) UMIfl 

rfc 5 


_ J . The website was entitled 
There were 19 galleries under the hyperlink 
"Softcore;" 17 galleries under the hyperlink "Hardcore;" and 3 galleries 
{Child Porn, Lo-Video, and Young Bang) under the hyperlink "Video." It should 
be noted that this member only website was accessed as a result of the May 16, 
2006 purch ase and appeared to contain the exact same content. In addition, 
SS/A r/)°/A u '| sent 119 images from "Hardcore 1 & 2" and 969 images from "Softcore 
1-6" to tne NCMEC for analysis with their Child Recognition Identification 
System. NCMEC responded, confirming that 171 image files depicted victims 
previously identified by law enforcement investigations. 

On June 23, 2006, SS/A [^23 issued a Custom summons to PayPal for account 
information related to Financial Services, (BF) . On June 27, 2006, PayPal 
provided the following relevant information: 


\D)(3j: u 


irtRinhl.vflflHhM.ZMFV 


Secret Members area . " 


Name: 
Address : 


(b)(6), (b)(7)(C) 


Telephone : 

Account # : 

Primary Email: 

Alternate Email: 

Account Created: 

Checking Account 
Legacy Federal Credit Union #[ 
Savings Account : 

America's First Credit Union * 


Fairfield, AL 35064 
(205) 52I” 11 ' 1 ! 


uno . com 
|@charter . net 


May 21, 2006 07:56:40 PDT 


An analysis of the Paypal transaction history indicates that the above account 
received approximately 80 payments, all for $79.95, between June 2 and 26, 
2006. The total amount received was approximately $6,300.00. As of June 24, 
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2006, approximately $5,800.00 had been withdrawn into the two listed bank 
accounts . 

On July 3, 2006, SS/A F%°/ r \° ) l issued Customs summons and preservation letters to: 


and e-mail account 

Investigation continues. 
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CASE NUMBER £ 


TITLE; COMMERICAL CP WEBSITE KNOWN AS 1 

CASE STATUS: 

INTERIM RPT 



REPORT DATE 

DATE ASSIGNED 

PROGRAM CODE 

REPORT NO. 

072106 

051706 

LEJ 

004 

RELATED CASE NUMBERS: 

COLLATERAL REQ 

8 

S 




COLLATERAL REQUEST / IN/ INVESTIGATIVE FINDINGS 

I 


TOPIC: COLLATERAL REQUEST REGARDING A COMMERICAL CP WEBSITE 


SYNOPSIS: 

On April 5, 2006, Senior Special Agent (SS/A) | (b>(6> (b>(7xc> | , Immigration and 

Customs Enforcement (ICE) , Cyber Crimes Center (C3) , Child Exploitation 
Section (CES) , received information from the National Center for Missing and 
Exploited Children (NCMEC) regardi ng a co mmercial website offering child 
pornography for sale via cyber tip I cb>(7>(E) | . Th e reported URL was 

l,,,, :,'"'.; 1 . ',' , 1 ; , which was kn °™ a s " EEsSSBiK] - 11 The member 

only website was known as ’ Ul" SS5SBP ” 

This report details a collateral request to ICE/RAC/Birmingham. 


DISTRIBUTION: 

SIGNATURE: 

1 (b)(7)(E) | 

| (b)(6), (b)(7)(C) I SENIOR SPEC AGENT 



APPROVED : 

1 (b)(6), (b)(7)(C) | ASST DIRECTOR (OI) 

ORIGIN OFFICE: KS 
HQ - CHIEF, CYBER CR 

TELEPHONE; 703 29I' U/ 7A“ A "I 

TYPIST: l™X™| 
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DETAILS OF INVESTIGATION 


On April 5, 2006, Senior Special Agent (SS/A) Q 


3 Immigration and 


Customs Enforcement (ICE), Cyber Crimes Center (C3), Child Exploitation 
Section (CES) , received information from the National Center for Missing and 
Exploited Children (NCMEC) regard ing a co mmercial website offering child 
pornography for sale via cybertip I (b)(7)(E) I . Th e reported URL was 

-/^l , which was known a s M | I - " The member 

only website was known as 'L t " 

C3/CES initiated an investigation into the individual <s) resp onsib le for 











The investigation has revealed two credit card payment methods; SegPay and 
PayPal, both of which are third party payment processors. Information is 
still being developed on SegPay. 

On June 23, 2006, SS/A l k 7)°/A u 1 issued a Custom summ ons to PayPal for account 
Information related to Financial Services , (BF) , | ' (b)(7)(E) | 

I (b)(7)(E) | . On June 27, 2006 , PayPal provided 

the following relevant information: 


Name ; 1 , W(6) (b)(7)(C) ) 

Address: ! (b)(6), (b)(7)(C) | 

Fairfield, AL 35064 

Telephone : (205) 521 

Account # : l ( b)(B) (b)(7)(C) | 

Primary Email : | (b)(s>.(b>(7>(o> En uno . com 

Alternate Email : l (fa)(G) (b)(7)(C) | ®char ter . net 
Account Created: May 21, 2006 07:56:40 PDT 
Checking Account : 

Legacy Federal Credit Union ( ft (b);s) waxo ~~| 

Savings Account: 

America's First Credit Union ti l (b>(G> (b>(7xc> | 

An analysis of the Paypal transaction history indicates that the above 
account received approximately 80 payments, all for $79.95, between June 2 
and 26, 2006. The total amount received was approximately $6,300.00. As of 
June 24, 2006, approximately $5,800.00 had been withdrawn into the two listed 
bank accounts . 


COLLATERAL REQUEST: 

C3/CES requests that RAC/Birmingham open an investigation targeting the 
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operator (s) of the member restricted website known as ** | I ; 
including the individual operating the above identified PayPal account. 
C3/CES will remain available to assist and support the RAC/Birmingham 
investigation. 
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041816 TECS II ORGANIZATION SUBJECT PAGE 

TECS RECORD ID: | (b)(7)(E) | 


SUB RECORD 01 


*** IDENTIFYING INFORMATION ========== 

h]SMP. |(b)(a): IK U.y.U. i abUSJ(d) Uh.ld vuAms' and ch.ldl 
ic . rinhtc rhusvis 1 1 « r k -wnwrt\ 

*** DESCRIPTIVE INFORMATION ========== 

*** ADDRESS AND TELEPHONE INFORMATIONS 
*** INFORMATION ON OFFICERS ========== 


*** OTHER INFORMATION ========================================================== 

FIN ID: DATE: 20 

*** RECORD OWNERSHIP INFORMATION ================================ =============== 

STATUS: SI PREVIOUS SUSPECT, CLOSED CASE DATE: 022514 

AGENCY: CKS ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: | (b>(6>,(b>(7>(C> | 

TELEPHONE: 972 44 ggZI TITLE: 

DATE ENTERED: 072808 LAST UPDATE: 022514 

CASE NUMBER: | (b)(7)(E) | 

REMARKS : 

T HE IS A PORTAL WEBSITE FOR THE FOLLOWING CP ADVERTISING WEBSITES: 

MORE 

*** PRIMARY ACCESS INFORMATION==================== ============================== 

LOOKOUT LEVEL: 
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OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: | (b)(7)(E) | SUB. RECORD 01 


*** IDENTIFYING INFORMATION ==================================================== 

NAME : I , h?l! a I 

*** DESCRIPTIVE INFORMATION ==================================================== 

*** ADDRESS AND TELEPHONE INFORMATION================= ====================== ==== 

*** INFORMATION ON OFFICERS ==================================================== 

*** OTHER INFORMATION ========================================================== 

*** RECORD OWNERSHIP INFORMATION====== ==================================== ====== 

STATUS: SI PREVIOUS SUSPECT, CLOSED CASE DATE: 022514 

AGENCY: CKS ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: | (b)(6), (b)(7)(C) | 

TELEPHONE: 972 44[^j™] TITLE: 

DATE ENTERED: 072808 LAST UPDATE: 022514 

CASE NUMBER: | (b)(7)(E) | 

REMARKS : 

SUBJECT IS LINKED TO SEVERAL COMMERCIAL CHILD EXPLOITATION WEBSITES; IDENTIFIED 
DURING THE PAYMENT PROCESS. LINKED TO CSS 

*** PRIMARY ACCESS INFORMATION========= ====================================== === 

LOOKOUT LEVEL: 
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TECS RECORD ID: | (b)(7)(E) | SUB RECORD 01 


*** IDENTIFYING INFORMATION ============:============ ===========:======== === = . 

NAMF • I IBHJj: ia u.b.L. 5 jsimoj Lraia victims ana i 

*** DESCRIPTIVE INFORMATION ==============:============== =================== ; 

*** ADDRESS AND TELEPHONE INFORMATION======================================; 

*** INFORMATION ON OFFICERS ===============================================: 

*** OTHER INFORMATION =========================== ===== = ======:=====:======!===: 

*** RECORD OWNERSHIP INFORMATION=========================== = ========== i =====: 

STATUS: SI PREVIOUS SUSPECT, CLOSED CASE DATE: 022514 

AGENCY: CKS ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: I (b>(6>,(b>(7>(C> | 

TELEPHONE: 972 44 ) | TITLE: 

DATE ENTERED: 072808 LAST UPDATE: 022514 

CASE NUMBER: | (b)(7)(E) | 

REMARKS : 

SUBJECT WEBSITE IS A PAYMENT WEBSITES LINKED TO SEVERAL COMMERCIAL CHILD 
EXPLOITATION WEBSITES; HAS BEEN LINKED TO DA PAY AND DA TECHNOLOGIES 

*** PRIMARY ACCESS INFORMATION================-============================ ; 

LOOKOUT LEVEL: 
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041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID : | (b)(7)(E) | SUB RECORD 02 


*** IDENTIFYING INFORMATION ==================================================== 

MAMF . I IBHJJ! i a U.S.L. 5 331M0J Lniia victims ana i 

' rinhtc fhOTV 1 S 11^8 I 

*** DESCRIPTIVE INFORMATION ==================================================== 

*** ADDRESS AND TELEPHONE INFORMATION=========================================== 

ADDRESS- STREET: HOSTED AT LAYERED TECHNOLOGIES APT/SUITE: 

CITY: DALLAS STATE: TX COUNTRY: US 

ZIP: 75202 COUNTY: TYPE: DATE: 111010 

*** INFORMATION ON OFFICERS ==================================================== 

*** OTHER INFORMATION ========================================================== 

*** RECORD OWNERSHIP INFORMATION================================================ 

STATUS: SO SUSPECT, OTHER DATE : 111010 

AGENCY: CKS ICE OI HQ - CHIEF, CYBERSMUGGL NAME: I (b)(6) (b)(7)(C) | 

TELEPHONE: 703 60 1 w y"l TITLE: 

DATE ENTERED: 111010 LAST UPDATE: 111010 

CASE NUMBER: I (b)(7)(E) I 

REMARKS : 

PAYMENT SITE ASSOCIATED WITH CHILD PORNOGRAPHY WEBSITES. 

*** PRIMARY ACCESS INFORMATION================================================== 

LOOKOUT LEVEL: 
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*** RECORD OWNERSHIP INFORMATION ======== ======== 

STATUS: SI PREVIOUS SUSPECT, CLOSED CASE 
AGENCY: CKS ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: 
TELEPHONE: 972 44 | TITLE: 

DATE ENTERED: 072808 LAST UPDATE: 02 2 S 14 



CASE NUMBER: 


REMARKS : 

SUBJECT WEBSITE LISTED AS THE . FOR. AN PURCHASE TO A COMMERCIAL CHILD 

EXPLOITATION WEBSITE KNOWN AS Ichln «nri r-hiin -Li I : LINKED TO DA PAY, DA TECHNOLOGIES, 
AND FLASHBILL 


*** PRIMARY ACCESS INFORMATION================== 

LOOKOUT LEVEL: 
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041816 TECS II ORGANIZATION SUBJECT PAGE 

TECS RECORD ID: | (b)(7)(E) | 


SUB RECORD 01 


*** I DENTIF YING INFORMATION 
NAME: E 


*** DESCRIPTIVE INFORMATION 


*** ADDRESS AND TELEPHONE INFORMATION - 


*** INFORMATION ON OFFICERS 


*** OTHER INFORMATION 


*** RECORD OWNERSHIP INFORMATION============================================= 

STATUS: SI PREVIOUS SUSPECT, CLOSED CASE DATE: 022514 

AGENCY: CKS ICE OI HQ - CHIEF, CYBERSMUGGL NAME: | (b)(6), (b)(7)(C) | 

TELEPHONE: 972 44 l wl 7A“ r,, l TITLE: 

DATE ENTERED: 072808 LAST UPDATE: 022514 

CASE NUMBER: I (b)(7)(E) | 

REMARKS : 

SUBJECT IS A MERCHANT LINKED TO AN UNDERCOVER PAYMENT FOR A COMMERCIAL CHILD 
EXPLOITATION WEBSITE KNOWN AS AMUSING KIDS. 

*** PRIMARY ACCESS INFORMATION=============================================== 

LOOKOUT LEVEL: 
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OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID : | (b)(7)(E) ~~| SUB RECORD 01 


*** IDENTIFYING INFORMATION *=========> 

I (b)(3): 1 8 U. t!. 12 . S 3bliS(d> Child victims and child I 
Iwitnesses* rights fbW3V18 U SC S 3509(d> (Federal! 

*** DESCRIPTIVE INFORMATION ==========; 

*** ADDRESS AND TELEPHONE INFORMATION^ 
*** INFORMATION ON OFFICERS ========== 

*** OTHER INFORMATION ================ 


*** RECORD OWNERSHIP INFORMATION================================================ 

STATUS: SI PREVIOUS SUSPECT, CLOSED CASE DATE: 022514 

AGENCY: CKS ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: | (b>(6>,(b>(7>(C> | 

TELEPHONE: 972 4 4 I TITLE: 

DATE ENTERED: 072808 LAST UPDATE: 022514 

CASE NUMBER: | (b)(7)(E) | 

REMARKS : 

SUBJECT WAS LISTED AT THE MER CHANT DURIN G A PURCHASE AT A COMMERCIAL CHILD 
EXPLOITATION WEBSITE KNOWN AS 

*** PRIMARY ACCESS INFORMATION================================================== 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 

Page 95 of 929 


OFFICIAL USE ONLY 



REQUESTED BY : 1 (b)(6), (b)(7)(C) ~| 

OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT J PAGE 1 

TECS RECORD ID: | (b)(7)(E) | SUB RECORD 01 


*** IDENTIFYING INFORMATION ==================================================== 

NAME • I ww li u.s.l. & jaiMaj umia victims ana eniia i 

rinh t « fhSnv 1 8 I I «? P K <WW>MWFo.ta I 

*** DESCRIPTIVE INFORMATION ==================================================== 

*** ADDRESS AND TELEPHONE INFORMATION=========================================== 

*** INFORMATION ON OFFICERS =====================================*============== 

*** OTHER INFORMATION ========================================================== 

*** RECORD OWNERSHIP INFORMATION================================================ 

STATUS: SI PREVIOUS SUSPECT, CLOSED CASE DATE: 022514 

AGENCY: CKS ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: | (b><6>, (b>(7> ( c> | 

TELEPHONE: 972 44 1 ^"1 TITLE: 

DATE ENTERED: 072808 LAST UPDATE: 022514 

CASE NUMBER : | (b)(7)(E) [ 


REMARKS : 

SUBJECT IS A PAYMENT WEBSITE LINKED TO NUMEROUS COMMERCIAL CHILD EXPLOITATION 
WEBSITES. 

*** PRIMARY ACCESS INFORMATION============= ========================== ========= 

LOOKOUT LEVEL: 
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(b)(6), (b)(7)(C) 
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041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: | (b)(7)(E) ... SUB RECORD 01 


*** IDENTIFYING INFORMATION 
NAME: 


t.fhwi»n«ir R ^nul 


*** DESCRIPTIVE INFORMATION 


*** ADDRESS AND TELEPHONE lNFORMATION==============:=: = = === = = ===================== 

*** INFORMATION ON OFFICERS ==================================================== 

*** OTHER INFORMATION ========================================================== 

*** RECORD OWNERSHIP INFORMATION=== =========== ===================*== ============= 

STATUS: SI PREVIOUS SUSPECT, CLOSED CASE DATE: 022514 

AGENCY: CKS ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: | (b>(S> l( b>(7>(C> | 

TELEPHONE: 972 44| | TITLE : 

DATE ENTERED: 072808 LAST UPDATE: 022514 

CASE NUMBER: | (b)(7)(E) | 


REMARKS : 

SUBJECT IS A COMMERCIAL CHILD EXPLOITATION ADVERTISING AND MEMBER ' RESTRICTED 
WEBSITE. 

*** PRIMARY ACCESS INFORMATION================================================== 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 

Page 97 of 929 


OFFICIAL USE ONLY 



REQUESTED BY : | (b)(6), (b)(7)(C) [ 

OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE • ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: I (b)(7)(E) I SUB RECORD 01 


*** IDENTIFYING INFORMATION ==================================================== 

NAME • I & juimuj uiiw vuumy unu | 

' I'-hi'H rinh*, M-iUSV IS I I q f K “WHOr I 

*** DESCRIPTIVE INFORMATION ==================================================== 

*** ADDRESS AND TELEPHONE INFORMATION=========================================== 

*** INFORMATION ON OFFICERS ==================================================== 

*** OTHER INFORMATION ========================================================== 

*** RECORD OWNERSHIP INFORMATION================================================ 

STATUS: SI PREVIOUS SUSPECT, CLOSED CASE DATE: 022514 

AGENCY: CKS ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: | (b)(G>,(b>(7> ( c> | 

TELEPHONE: 972 44 | | TITLE: 

DATE ENTERED: 010208 LAST UPDATE: 022514 

CASE NUMBER: I (b)(7)(E) | 

REMARKS : 

CHILD EXPLOITATION ADVERTISING THAT CONTAINED LINKS TO FOUR SEPARATE COMMERCIAL 
CHILD EXPLOITATION WEBSITES: \ vn^nrw | 

I iujui rerrgr i 
Ifiti r.hilrl viitima nnrl rhil I • 

*** PRIMARY ACCESS INFORMATION================================================== 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 

Page 98 of 929 


OFFICIAL USE ONLY 



REQUESTED BY : | (b)(6), (b)(7)(C) | 

OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID; | (b)(7)(E) | SUB RECORD 01 


*** IDENTIFYING INFORMATION ============================================== 

NAMP • I IBJUJ' 18 U.S.L. a JaU^OJ Ulllfl VlCfimS AIM WHO 1 

‘ rinhh. 1 St I I g K -Wn<Wrt\ ( Fo<W a l Wi<-I 

*** DESCRIPTIVE INFORMATION ============================================== 

*** ADDRESS AND TELEPHONE INFORMATION========= ==================== ======== 

*** INFORMATION ON OFFICERS ============================================== 

*** OTHER INFORMATION ==================================================== 

FIN ID: DATE: 20 

*** RECORD OWNERSHIP INFORMATION=========================================~ 

STATUS: SI PREVIOUS SUSPECT, CLOSED CASE DATE: 022514 

AGENCY: CKS ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: | (b>(6> (b>(7) ( c> | 

TELEPHONE: 972 44 | 1UM 7A°” ,) I TITLE: 

DATE ENTERED: 010208 LAST UPDATE: 022514 

CASE NUMBER: | (b)(7)(E) | 

REMARKS : 

THIS DOMAIN HOUSES AT LEAST SEVERAL CHILD EXPLOITATOIN MEMBER WEBSITES 
| — (ujijj . I AU8L, s jjutnuv-nnu mia iTTi b uhu ' u iiii u wm i yL-L-yi, ny i uL-. l auai y.'ju ' ii i .un r y i jy i a i ' .nuumi. h i uiwuuum — i 


*** PRIMARY ACCESS INFORMATION: 
LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 

Page 99 of 929 


OFFICIAL USE ONLY 




REQUESTED BY : | ib)(B), (b)(7)(C) | 

OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: | (b)(7)(E) | SUB RECORD 01 


*** IDENTIFYING INFORMATION ==================================================== 

NAMP ■ I IBHJV 14 u.s.L. 5 jauaifl) umia victims ana i 

*** DESCRIPTIVE INFORMATION ==================================================== 

*** ADDRESS AND TELEPHONE INFORMATION=========================================== 

*** INFORMATION ON OFFICERS ==================================================== 

*** OTHER INFORMATION ========================================================== 

*** RECORD OWNERSHIP INFORMATION================================================ 

STATUS: SI PREVIOUS SUSPECT, CLOSED CASE DATE: 022514 

AGENCY: CKS ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: | (b>(6>,(b> ( 7>(C> | 

TELEPHONE: 972 44j^™3 TITLE : 

DATE ENTERED: 010208 LAST UPDATE: 022514 

CASE NUMBER: | (b)(7)(E) | 

REMARKS : 

THIS IS AN CHILD EXPLOITATION ADVERTISING AND MEMBER RESTRICTED WEBSITE. 

*** PRIMARY ACCESS INFORMATION================================================== 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 

Page 100 of 929 


OFFICIAL USE ONLY 



REQUESTED BY : | ^ b>, ( b)(7)(C) | 

OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: | (b)(7)(E) | SUB RECORD 01 


*** IDENTIFYING INFORMATION ========== 

NAMF • I miy 14 u.s.L. 5 JuuaTu) uwu vuiunu ami | 

iNrtJ ' Inhiirt rinhh. fhVnvia 1 1 «; i- K <wn<yl 

*** DESCRIPTIVE INFORMATION ========== 

*** ADDRESS AND TELEPHONE INFORMATION 
*** INFORMATION ON OFFICERS ========== 

*** OTHER INFORMATION ================ 


*** RECORD OWNERSHIP INFORMATION ===================================== ========== 

STATUS: SI PREVIOUS SUSPECT, CLOSED CASE DATE: 022514 

AGENCY: CKS ICE OI HQ - CHIEF, CYBERSMUGGL NAME: | (b>(6>,(b>(7>(C> 1 

TELEPHONE: 972 44 1 ww*"*' 7 | TITLE : 

DATE ENTERED: 010208 LAST UPDATE: 022514 

CASE NUMBER: | (b)(7)(E) | 

REMARKS : 

THIS IS AN CHILD EXPLOITATION ADVERTISING AND MEMBER RESTRICTED WEBSITE 

*** PRIMARY ACCESS INFORMATION==== ======================================== ====== 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 

Page 101 of 929 


OFFICIAL USE ONLY 



REQUESTED BY: 


(b)(6), (b)(7)(C) 


OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 

PAGE 1 


SUB RECORD 01 


*** ADDRESS AND TELEPHONE INFORMATION====== ========= = = === ===== =============== ==:= 

*** INFORMATION ON OFFICERS ==================================================== 

*** OTHER INFORMATION ========================================================== 

*** RECORD OWNERSHIP INFORMATION s ====== == =================== = ============== ====== 

STATUS: SI PREVIOUS SUSPECT, CLOSED CASE DATE: 022514 

AGENCY: CKS ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: | (b>(6>,(b>(7>(C> | 

TELEPHONE: 972 44 | | TITLE: 

DATE ENTERED: 010208 LAST UPDATE: 022514 

CASE NUMBER: | (b)(7)(E) | 

REMARKS : 

THIS IS AN CHILD EXPLOITATION ADVERTISING AND MEMBER RESTRICTED WEBSITE 

*** PRIMARY ACCESS INFORMATION================================================== 

LOOKOUT LEVEL: 


041816 TECS II ORGANIZATION SUBJECT 

TECS RECORD ID: | (b)(7)(E) | 


*** I DENTIFYING INFORMATION 

NAME * I (b)(3): 1 8 U.S.C. § 3bU9(d) Child victims* and I 
™ 1C, . | ch i| d witnesses' rights. fbW31: 18 U.S.C. S 35Q9fl 

*** DESCRIPTIVE INFORMATION 


OFFICIAL USE ONLY 


TECS II INFORMATION 

Page 102 of 929 


OFFICIAL USE ONLY 



REQUESTED BY : | (b)(6), (b)(7)(C) | 

OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT w PAGE 1 

TECS RECORD ID: | (b)(7)(E) | SUB RECORD 01 


*** IDENTIFYING INFORMATION ==============================================. 

NAME* I IBJIJJ' is u.b.L. 5 J 3 uy( 0 ) uwa victims ana i 

' Ir-hilrt ...itngsc^ rinhK. fhU-tM « IKT i -WIWl 

*** DESCRIPTIVE INFORMATION ==============================================, 

*** ADDRESS AND TELEPHONE INFORMATION============ ================= ======== 

*** INFORMATION ON OFFICERS ==============================================; 

*** OTHER INFORMATION ====================================================, 

FIN ID: DATE: 20 

*** RECORD OWNERSHIP INFORMATION^ ================================ =========: 

STATUS: SI PREVIOUS SUSPECT, CLOSED CASE DATE: 092211 

AGENCY: CBI ICE 01 - BIRMINGHAM AL NAME: | (b>(6>,(b>(7>(C> | 

TELEPHONE: 205 2 9 | ) TITLE : 

DATE ENTERED: 081408 LAST UPDATE: 092211 

CASE NUMBER: | (b)(7)(E) | 

REMARKS : 

THE NAME IS ASSOCIATED WITH PAYMENT WEBSITES THAT PROCESS PAYMENT FOR 
COMMERCIAL CHILD EXPLOITATION WEBSITES. IT IS UNCLEAR IF THIS IS A REAL 
ENTITY. IT IS LINKED TO FLASHBILL AND DA TECHNOLOGIES 

*** PRIMARY ACCESS INFORMATION========= ========================== =========: 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 

Page 103 of 929 


OFFICIAL USE ONLY 



(b)(6), (b)(7)(C) 


REQUESTED BY : [ 

OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: | (b)(7)(E) | SUB RECORD 02 


*** IDENTIFYING INFORMATION ==============================================; 

NAME: DA PAY 

*** DESCRIPTIVE INFORMATION =====================================±======== ; 

*** ADDRESS AND TELEPHONE INFORMATION========= ========================= === 

*** INFORMATION ON OFFICERS 

*** OTHER INFORMATION ==================================================== 

FIN ID: DATE: 20 

*** RECORD OWNERSHIP INFORMATION======= ========================= ========== 

STATUS: SI PREVIOUS SUSPECT, CLOSED CASE DATE: 022514 

AGENCY: CKS ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: | (b)(6), (b)(7)(C) j 

TELEPHONE: 972 44 | I TITLE: 

DATE ENTERED: 010208 LAST UPDATE: 022514 

CASE NUMBER: | (b)(7)(E) 1 

REMARKS : 

THE NAME IS ASSOCIATED WITH PAYMENT WEBSITES THAT PROCESS PAYMENT FOR 
COMMERCIAL CHILD EXPLOITATION WEBSITES. IT IS UNCLEAR IF THIS IS A REAL 
ENTITY. IT IS LINKED TO FLASHBILL AND DA TECHNOLOGIES 

*** PRIMARY ACCESS INFORMATION============================================; 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 

Page 104 of 929 



REQUESTED BY : Q 


041816 

TECS RECORD ID 


OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 

TECS II ORGANIZATION SUBJECT PAGE 1 

' (b)(7)(E > I SUB RECORD 01 


*** IDENTIFYING INFORMATION ========== 

Ma mi? • I IDJIJJ! 14 U.S.L. 4 jauaiaj Lniia victims see emia witnesses rigntsiBNJj: 

1VA1 1C. . | llftrt: -WncilH' Vir-tims' Prntpr-tinn Pinhts Art! 


] 


*** DESCRIPTIVE INFORMATION ========== 

*** ADDRESS AND TELEPHONE INFORMATION; 
*** INFORMATION ON OFFICERS ========== 

*** OTHER INFORMATION ================ 


*** RECORD OWNERSHIP INFORMATION==========================================: 

STATUS: SI PREVIOUS SUSPECT, CLOSED CASE DATE: 022514 

AGENCY: CKS ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: | (b>(6>,(b>(7> ( c> | 

TELEPHONE: 972 44|' D ™''>| TITLE: 

DATE ENTERED: 010208 LAST UPDATE: 022514 

CASE NUMBER: | (b)(7)(E) [ 

REMARKS : 


(b)(7)(E) 


*** PRIMARY ACCESS INFORMATION^- 
LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 

Page 105 of 929 


OFFICIAL USE ONLY 






REQUESTED BY : | (bj s>,(b) 7> c) [ 

OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: | (b)(7)(E) | SUB RECORD 01 


*** I DENTIFYING INFORMATION = = 
NAME: 


*** DESCRIPTIVE INFORMATION ==================================================== 

*** ADDRESS AND TELEPHONE INFORMATION=========================================== 

*** INFORMATION ON OFFICERS ==================================================== 

*** OTHER INFORMATION ========================================================== 


*** RECORD OWNERSHIP INFORMATION=================================«======== 

STATUS: SI PREVIOUS SUSPECT, CLOSED CASE D ATE : 022514 

AGENCY: CKS ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: I (b)(6), (b)(7)(C) | 

TELEPHONE: 972 44| IWMWJ | TITLE : 

DATE ENTERED: 010208 LAST UPDATE: 022514 

CASE NUMBER: | ib) ( 7 )( E) | 

REMARKS : 


(b)(7)(E) 


ADDITIONAL TRANSACTIONS HAVE IDENTIFIED THIS EMAIL ADDRESS. 

*** PRIMARY ACCESS INFORMATION======================================: 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 

Page 106 of 929 


OFFICIAL USE ONLY 





REQUESTED BY : | (b)(6), (b)(7)(C) ~] 

OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID; | (b)(7)(E) | SUB RECORD 01 


*** IDENTIFYING INFORMATION ==================================================== 

I — IBJIJj: ia u.s.l. a J3uy(aj tnna victims ana enna — i 

rinhh, IB I I g T S BSOWHl I F«.H ora l Wirt I 

*** DESCRIPTIVE INFORMATION ==================================================== 

*** ADDRESS AND TELEPHONE INFORMATION=========================================== 

*** INFORMATION ON OFFICERS ==================================================== 

*** OTHER INFORMATION ========================================================== 

*** RECORD OWNERSHIP INFORMATION=====-=========================================== 

STATUS: SI PREVIOUS SUSPECT, CLOSED CASE DATE: 022514 

AGENCY: CKS ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: | (b>(6>,(b>(7>(C> | 

TELEPHONE: 972 44|^A UK 'M TITLE: 

DATE ENTERED: 010208 LAST UPDATE: 022514 

CASE NUMBER: | (b)(7)(E) | 

REMARKS : 


(b)(7)(E) 


ADDITIONAL TRANSACTIONS HAVE IDENTIFIED THIS EMAIL ADDRESS. 

*** PRIMARY ACCESS INFORMATION===================================-============== 

LOOKOUT LEVEL : 


OFFICIAL USE ONLY 


TECS II INFORMATION 

Page 107 of 929 


OFFICIAL USE ONLY 





REQUESTED BY : | (b) 6>,(b>:7>;o: | 

OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: | (b)(7)(E) | SUB RECORD 01 

*** IDENTIFYING INFORMATION ==================================================== 

NAMF • I 1 ° 3 ^rinu victims aim u 

' Inhilrt rinhh. fhsHvm 11^8 isnoil 1 

*** DESCRIPTIVE INFORMATION ==================================================== 

*** ADDRESS AND TELEPHONE INFORMATION====================== ==================== = 

*** INFORMATION ON OFFICERS ==================================================== 

*** OTHER INFORMATION ========================================================== 

*** RECORD OWNERSHIP INFORMATION======= =================================== ====== 

STATUS: SI PREVIOUS SUSPECT, CLOSED CASE DATE : 022514 

AGENCY: CKS ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: I (b)(6), (b)(7)(C) | 

TELEPHONE: 972 44 1 wi 7A UA "l TITLE: 

DATE ENTERED: 010208 LAST UPDATE: 022514 

CASE NUMBER: | (b)(7)(E) | 


REMARKS: 

| (b)(7)(E) 


*** PRIMARY ACCESS INFORMATION==== 
LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 

Page 108 of 929 


OFFICIAL USE ONLY 





REQUESTED BY : | (b)(B>, (b)(7)(C) [ 

OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: | (b)(7)(E) ~| SUB RECORD 01 


** * IDENTIFYING INFORMATION ==================================================== 

NAME • \ W[iy 141 u ;5 L ' 4 juuy W '-'™ u ™ ™ IU | 

rMU«IC. . | rinhtc M-iUSV 1 S I I g l~ K -tSriQM\ IFoH I 

*** DESCRIPTIVE INFORMATION ==================================================== 

*** ADDRESS AND TELEPHONE INFORMATION======= ============================= ======= 

*** INFORMATION ON OFFICERS ==================================================== 

*** OTHER INFORMATION ========================================================== 

*** RECORD OWNERSHIP INFORMATION================================================ 

STATUS: SI PREVIOUS SUSPECT, CLOSED CASE DATE: 022514 

AGENCY: CKS ICE 01 HO - CHIEF, CYBERSMUGGL NAME: | (b>(6>,(b> ( 7>(C> | 

TELEPHONE: 972 44j | TITLE: 

DATE ENTERED: 0102 08 LAST UPDATE: 022514 

CASE NUMBER: | (b)(7)(E) [ 

REMARKS : 


(b)(7)(E) 


*** PRIMARY ACCESS INFORMATION = 
LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 

Page 109 of 929 


OFFICIAL USE ONLY 






REQUESTED BY : | m B), (b)(7)(C) ] 

OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: | (b)(7)(E) | SUB RECORD 01 


*** IDENTIFYING INFORMATION ========== 

NAME • I rn 14 U.S.L. s jauaiuj Cnnu wsihw unu am | 

*** DESCRIPTIVE INFORMATION ========== 

*** ADDRESS AND TELEPHONE INFORMATION 

*** INFORMATION ON OFFICERS ========== 

OFFICER- LAST NAME: 

FIRST NAME: 

POSITION: DIRECTOR 

*** OTHER INFORMATION ===================================================== 

FIN ID: DATE: 20 

*** RECORD OWNERSHIP INFORMATION- ================================== ======== 

STATUS: SI PREVIOUS SUSPECT, CLOSED CASE DATE : 092211 

AGENCY: CBI ICE 01 - BIRMINGHAM AL NAME: \Z I 

TELEPHONE: 205 29 | |ll|i y' ) I TITLE: 

DATE ENTERED: 081408 LAST UPDATE: 092211 

CASE NUMBER: | (b)(7)(E) | 

REMARKS : 


(b)(7)(E) 


MIDDLE NAME: 


*** PRIMARY ACCESS INFORMATION==================== =================™=====™== 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 

Page 110 of 929 


OFFICIAL USE ONLY 






REQUESTED BY : | (bj (6), (b)(7)(C) j 

OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: | (b)(7)(E) | SUB RECORD 02 


*** IDENTIFYING INFORMATION ==================================================== 

NAME • I Ibhjj: is u.b.L. 5 J3uy(aj umia vienms ana who i 

* ‘ ’ '-inhtc 1 g I I q f K gSHQMS IF 0 H«.r„ll 

*** DESCRIPTIVE INFORMATION ==================================================== 

*** ADDRESS AND TELEPHONE INFORMATION========== ============================== === 

*** INFORMATION ON OFFICERS ==================================================== 

*** OTHER INFORMATION ============================= 

*** RECORD OWNERSHIP INFORMATION ================= = 

STATUS: SI PREVIOUS SUSPECT, CLOSED CASE 
AGENCY: CKS ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: [ 

TELEPHONE: 972 44 | | TITLE : 

DATE ENTERED: 010208 LAST UPDATE: 022514 

CASE NUMBER: | (b)(7)(E) | 

REMARKS : 


(b)(7)(E> 


DATE: 022514 

(b)(6), (b)(7)(C) I 


*** PRIMARY ACCESS INFORMATION= ====================================== =========== 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 

Page 1 1 1 of 929 


OFFICIAL USE ONLY 






(b)(6), (b)(7)(C) 


REQUESTED BY : [ 

OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: | (b)(7)(E) ~| SUB RECORD 01 


*** IDENTIFYING INFORMATION ============================================== 

I IB)(J)1 14 U.S.L. 5 Jsua(O) Lniia victims ana cmia witnesses ngrws,iBM! i*| 

- I I I <; r K -fSnQMN Pm. 0 r.;r,~ .nH P.nhR Art\ | 

*** DESCRIPTIVE INFORMATION ============================================== 

*** ADDRESS AND TELEPHONE INFORMATION===================================== 

*** INFORMATION ON OFFICERS ============================================== 

*** OTHER INFORMATION ==================================================== 

DATE: 022514 

b)(S), (b)(7)(C) | 


CASE NUMBER: | (b)(7)(E) | 

REMARKS : 

I (b)(7)(E) 


*** RECORD OWNERSHIP INFORMATION===================== 

STATUS: SI PREVIOUS SUSPECT, CLOSED CASE 

AGENCY: CKS ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: | 

TELEPHONE: 972 44T u «7A un ' ; l TITLE: 

DATE ENTERED: 010208 LAST UPDATE: 022514 


*** PRIMARY ACCESS INFORMATION: 
LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 

Page 112 of 929 


OFFICIAL USE ONLY 




(b)(6), (b)(7)(C) 


REQUESTED BY : [ 

OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE- ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: | (b)(7)(E) | SUB RECORD 01 

*** IDENTIFYING INFORMATION ==============================:====================== 

I (B)(3)! i a u.s.l. a jsua(fl) cmia victims ana emia witnesses ngnrs.iB) i 

■ I I I ^ r K (FaHoral \l\r ti^ c ' Pmtertinn anrt Pinh t « Art' | 

*** DESCRIPTIVE INFORMATION ==================================================== 

*** ADDRESS AND TELEPHONE INFORMATION=========================================== 

*** INFORMATION ON OFFICERS ==================================================== 

*** OTHER INFORMATION ========================================================== 

*** RECORD OWNERSHIP INFORMATION================================== ============== 

STATUS: SI PREVIOUS SUSPECT, CLOSED CASE DATE: 022514 

AGENCY: CKS ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: | <b>(S>,(b> ( 7>(C> | 

TELEPHONE: 972 44 | w ™''| TITLE: 

DATE ENTERED: 010208 LAST UPDATE: 022514 

CASE NUMBER: | (b)(7)(E) | 

REMARKS : 

I (b)(7)(E) j 


*** PRIMARY ACCESS INFORMATION: 
LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 

Page 113 of 929 


OFFICIAL USE ONLY 




REQUESTED BY; | (b)(6), (b)(7)(C) | 

OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: | (b)(7)(E) | SUB RECORD 01 


*** IDENTIFYING INFORMATION ==================================================== 

NAME • I MW 1 4 u.s.l. s juimuj urn vuuinii unu aiu imihuuhw i 

lti-VllC. | rinhtc fhSm-IB I I «! f R IWHOM! ( Mrtim.- Pmtertinn a nH I 

*** DESCRIPTIVE INFORMATION ==================================================== 

*** ADDRESS AND TELEPHONE INFORMATION =============================== =========== 

*** INFORMATION ON OFFICERS =========================== ==========^======= ======= 

*** OTHER INFORMATION ========================================================== 

FIN ID: DATE: 20 

*** RECORD OWNERSHIP INFORMATION================================================ 

STATUS: SI PREVIOUS SUSPECT, CLOSED CASE DATE: 022514 

AGENCY: CKS ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: | (b>(6>(b>(7>(C> ] 

TELEPHONE: 972 44 1^7^'' I TITLE: 

DATE ENTERED; 011108 LAST UPDATE; 022514 

CASE NUMBER: | (b)(7)(E) [ 

REMARKS : 

SUBJECT URL IS WAS A MEMBER RESTRICTED WEBSITE KNOWN AS 1^77^7— LTZ,\ AS OF 
DECEMBER 2006 

*** PRIMARY ACCESS INFORMATION================================================== 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 

Page 114 of 929 


OFFICIAL USE ONLY 



REQUESTED BY : Q 


OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 

TECS RECORD ID: | (b)(7)(E) | 


SUB RECORD 01 


*** IDENTIFYING INFORMATION ==================================================== 

NAME • I miy 14 u.s.L. & juuaiuj urn mm unu am | 

1C . rinhtc fhWIV 1 « I I ^ E -WWWHl (FoH 0 r n l I 

*** DESCRIPTIVE INFORMATION ==================================================== 

*** ADDRESS AND TELEPHONE INFORMATION========= =============================== === 

*** INFORMATION ON OFFICERS ==================================================== 

*** OTHER INFORMATION ========================================================== 

*** RECORD OWNERSHIP INFORMATION==================================>============== 

STATUS: SI PREVIOUS SUSPECT, CLOSED CASE DATE : 022514 

AGENCY: CKS ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: | (b)(6), (b)(7)(C) | 

TELEPHONE: 972 44 | | TITLE : 

DATE ENTERED: 040108 LAST UPDATE: 022514 

CASE NUMBER: | (b)(7)(E) | 

REMARKS : 

SUBJECT WEBSITE IS THE MEMBER RESTRICTED WEBSITE FOR IS” I 

*** PRIMARY ACCESS INFORMATION================================================== 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 

Page 115 of 929 


OFFICIAL USE ONLY 



REQUESTED BY : | = 6), (b)(7)(C) ~~| 

OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: [ (b)(7)(E) | SUB RECORD 01 


** * IDENTIFYING INFORMATION ==============================================’ 

NAMF • \ miy u - !kL - 4 Juuy ' u) C,m il ™’ !! UMU m " a " muflsus I 

iNrtl ■ I rinhtc fhS^V 1 « I I <? n R IFcrt^l Mrtim.,- Prnto^Hnn I 

*** DESCRIPTIVE INFORMATION ===========================:== = ==== ============; 

*** ADDRESS AND TELEPHONE INFORMATION= ================================= === 

*** INFORMATION ON OFFICERS ============================================== 

*** OTHER INFORMATION ==================================================== 

*** RECORD OWNERSHIP INFORMATION========== ====================== ========== 

STATUS: SI PREVIOUS SUSPECT, CLOSED CASE DATE : 022514 

AGENCY: CKS ICE OI HQ - CHIEF, CYBERSMUGGL NAME; | (b)(6), (b)(7)(C) [ 

TELEPHONE: 972 44 | | TITLE: 

DATE ENTERED: 040108 LAST UPDATE: 022514 

CASE NUMBER: | (b)(7)(E) | 

REMARKS : 

SUBJECT WEBSITE IS A PAYMENT WEBSITE THAT HAS BEEN LINKED TO NUMEROUS 
COMMERCIAL CHILD EXPLOITATION WEBSITES. 

*** PRIMARY ACCESS INFORMATION======= =============================== ======’ 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 
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OFFICIAL USE ONLY 



(b)(6), (b)(7)(C) 


REQUESTED BY : [ 

OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: | (b)(7)(E) | SUB RECORD 01 


*** IDENTIFYING INFORMATION ===============================================; 

NAME • I IWU). 14 u.s.L. 5 Juua(U) uwu mma urn i 

*** DESCRIPTIVE INFORMATION ================================================ 

*** ADDRESS AND TELEPHONE INFORMATION============== ======================== ; 

*** INFORMATION ON OFFICERS ================================================ 

*** OTHER INFORMATION ====================================================== 

*** RECORD OWNERSHIP INFORMATION============================================ 

STATUS: SI PREVIOUS SUSPECT, CLOSED CASE DATE: 022514 

AGENCY: CKS ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: | (b>(6>,(b>(7>(C> | 

TELEPHONE: 972 44| k “ n 7A UA '' I TITLE : 

DATE ENTERED: 040108 LAST UPDATE: 022514 

CASE NUMBER: I (b)(7)(E) I 

REMARKS : 

SUBJECT WEBSITE IS AN ADVERTISING WEBSITE CONTAINING HYPERLINKS TO NUMEROUS 
COMMERCIAL CHILD EXPLOITATION WEBSITES. 

*** PRIMARY ACCESS INFORMATION============================================== 

LOOKOUT LEVEL : 


OFFICIAL USE ONLY 


TECS II INFORMATION 

Page 117 of 929 


OFFICIAL USE ONLY 



REQUESTED BY : | (b)(6), (b)(7)(C) [ 

OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE, ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: | (b)(7)(E) | SUB RECORD 01 


*** IDENTIFYING INFORMATION ==================================================== 

NAME • I m H - 14 U.S.L. 5 JUUUIU) uwu uusihui unu U 

id . iphilH Hnhn ' i r R -tsnorP 

*** DESCRIPTIVE’ INFORMATION ===================== = = = = = ============ ======== ===== = 

*** ADDRESS AND TELEPHONE INFORMATION=========================================== 

*** INFORMATION ON OFFICERS ==================================================== 

*** OTHER INFORMATION ========================================================== 

*** RECORD OWNERSHIP INFORMATION=========== ====================== =============== 

STATUS: SI PREVIOUS SUSPECT, CLOSED CASE DATE : 022514 

AGENCY: CKS ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: | (b>(6>,(b>(7>(C> ] 

TELEPHONE: 972 44| I TITLE: 

DATE ENTERED: 102406 LAST UPDATE: 022514 

CASE NUMBER: | (b)(7)(E) | 

REMARKS : 

SUBJECT WEBSITE CONTAINS SEVERAL CP ADVERTISING WEBSITES: 

| (b)(3): 18 U.S.C. § 3509(d) Child victims' and child witnesses' rights, (b)(3): 18 U.S.C. § 3509(d) (Federal Victims' Protection and Rights Act) | 

INVESTIGATION), AND ESSSgB < LINK T0 I "SB Z3 

*** PRIMARY ACCESS INFORMATION==================== ================ ============== 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 

Page 118 of 929 


OFFICIAL USE ONLY 


(b)(6), (b)(7)(C) 


REQUESTED BY : [ 

OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: | (b)(7)(E) | SUB RECORD 01 


*** IDENTIFYING INFORMATION == = 
NAMF • I — miy 14 U i> L 4 Juu5iu) u ’" u ana — 

lNrtJ ICl ‘ rinhh. lUli-ip K 'tSOQMN ( 


] 


*** DESCRIPTIVE INFORMATION ==================================== 


*** ADDRESS AND TELEPHONE INFORMATION 

*** INFORMATION ON OFFICERS ========== 

OFFICER- LAST NAME: 

FIRST NAME 

*** OTHER INFORMATION ================================ 

FIN ID: DATE: 20 


MIDDLE NAME: 


*** RECORD OWNERSHIP INFORMATION================================================ 

STATUS: SI PREVIOUS SUSPECT, CLOSED CASE DATE : 092211 

AGENCY: CBI ICE 01 - BIRMINGHAM AL NAME: | (b)(6) (b)(7)(C) | 

TELEPHONE: 205 2 9 | I TITLE: 

DATE ENTERED: 081006 LAST UPDATE: 092211 

CASE NUMBER: | (b)(7)(E) | 

REMARKS : 

WEBSITE IS AN ADVERTISING SITE FOR CHILD PORNOGRAPHY MEMBRESHIP SITE. 


*** PRIMARY ACCESS INFORMATION============================== 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 

Page 119 of 929 


OFFICIAL USE ONLY 



REQUESTED BY : | b? 3) ; (b)(7;,C; ~| 

OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: | (b)(7)(E) | SUB RECORD 02 


*** IDENTIFYING INFORMATION === 

N&MP • I 18 U.y.D. ^ BbUy(d> (Jhild victims' and child — I 

• witnesses’ rights ftaU3V 18 U S C S 3509M1 (Federal Vic I 


*** DESCRIPTIVE INFORMATION =================================== 


*** ADDRESS AND TELEPHONE INFORMATION=========================================== 

*** INFORMATION ON OFFICERS ==================================================== 

*** OTHER INFORMATION ========================================================== 


*** RECORD OWNERSHIP INFORMATION=========================================== 

STATUS: SI PREVIOUS SUSPECT, CLOSED CASE DATE: 022514 

AGENCY: CKS ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: | <b>(6> (b>(7> ( c> | 

TELEPHONE: 972 44 l kun 7A ur> ' I TITLE: 

DATE ENTERED: 052206 LAST UPDATE: 022514 

CASE NUMBER: | (b)(7)(E) | 

REMARKS : 

SUBJECT WEBSITE IS AN ADVERTISING WE BSITE OFFERING ACCESS TO A MEMBER ONLY 
CP WEBSITE KNOWN AS 1° ^ It™ I 

*** PRIMARY ACCESS INFORMATION============================================= 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 


Page 120 of 929 



REQUESTED BY : | (b)(6), (b)(7)(C) j 

OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: | (b)(7)(E) | SUB RECORD 01 


*** IDENTIFYING INFORMATION ==================================================== 

NAME • I IBHJj: i a u.s.l. $ jaua^aj unna victims ana eniia witnesses rignts, i 

" lC ' ■ I 1 S I I q r F \firtim*- P rn.prt.nn a nH Pinh tc A I 

*** DESCRIPTIVE INFORMATION ==================================================== 

*** ADDRESS AND TELEPHONE INFORMATION============================^===========:=== 

*** INFORMATION ON OFFICERS ==================================================== 

*** OTHER INFORMATION ========================================================== 

FIN ID: DATE: 20 

*** RECORD OWNERSHIP INFORMATION==== ========================================== == 

STATUS: SI PREVIOUS SUSPECT, CLOSED CASE DATE : 092211 

AGENCY: CBI ICE 01 - BI RMINGHAM AL NAME: | (b)(6), (b)(7)(C) ] 

TELEPHONE: 205 29 EeCT TITLE: 

DATE ENTERED: 073106 LAST UPDATE: 092211 

CASE NUMBER: | (b)(7)(E) | 

REMARKS ; 

WEBSITE HOUSES HUNDREDS OF IMAGES OF CHILD PORNOGRAPHY. 

*** PRIMARY ACCESS INFORMATION================================================== 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 
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OFFICIAL USE ONLY 



REQUESTED BY: | ovs), (b)(7)(C) | 

OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: | (b)(7)(E) | SUB RECORD 02 


*** IDENTIFYING INFORMATION ============================================== 

MIMP, I i a U.b.u S jsutna) Luna victims ana emia witnesses ngnrs. i 

■ 1 S I I q r R VM QMS /Fariaral 'IWm.' Prnto^hnn Pinh t « A I 

*** DESCRIPTIVE INFORMATION ============================================== 

*** ADDRESS AND TELEPHONE INFORMATION===================================== 

*** INFORMATION ON OFFICERS ============================================== 

*** OTHER INFORMATION ==================================================== 

*** RECORD OWNERSHIP INFORMATION========================================== 

STATUS: SI PREVIOUS SUSPECT, CLOSED CASE DATE: 022514 

AGENCY: CKS ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: | (b)(6), (b)(7)(C) | 

TELEPHONE: 972 44| IUJ ™' J I TITLE: 

DATE ENTERED: 052206 LAST UPDATE: 022514 

CASE NUMBER: | (b)(7)(E) | 

REMARKS : 

SUBJECT WEBSITE IS A MEMBER ONLY CP WEBSITE KNOWN AS 1,,,^ ZX* It™ ‘T.T,, I; THE 
WEBSITE IS CURRENTLY HOSTED IN BUNDABERG, QUEENSLAND, AU 

*** PRIMARY ACCESS INFORMATION============================================ 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 


Page 122 of 929 



REQUESTED BY; 


(b)(6), (b)(7)(C) 


OFFICIAL USE ONLY 

041816 

TECS RECORD ID: | (b)(7)~ 


-- TECS II INFORMATION -- OFFICIAL USE ONLY 
TECS II ORGANIZATION SUBJECT PAGE 1 

| SUB RECORD 01 


*** IDENTIFYING INFORMATION = ================================: ============ = : 

NAME: I 

*** DESCRIPTIVE INFORMATION = = = =============================== ====:======= = ! 

*** ADDRESS AND TELEPHONE INFORMATION======================== ============= 

*** INFORMATION ON OFFICERS ============================================== 

*** OTHER INFORMATION === = ===== = = ============ ==================== 55 ========; 

FIN ID: DATE: 20 

*** RECORD OWNERSHIP INFORMATION========= ==================== ============= 

STATUS: SI PREVIOUS SUSPECT, CLOSED CASE DATE : 092211 

AGENCY: CBI ICE 01 B IRMINGHAM AL NAME: | (b)( 6 ), (b)(7)(C) 1 

TELEPHONE: 205 2 9^7'"! TITLE: 

DATE ENTERED: 073106 LAST UPDATE: 092211 

CASE NUMBER: | (b)(7)(E) | 


REMARKS: 

EMAIL ADDRESS IS RELATED TO A WEBSITE OFFERING CHILD PORNOGRAPHY. 

*** PRIMARY ACCESS INFORMATION=================================== 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 

Page 123 of 929 


OFFICIAL USE ONLY 



REQUESTED BY : | (b)(6), (b)(7)(C) | 

OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: | (b)(7)(E) | SUB RECORD 02 


*** IDENTIFYING INFORMATION ==================================================== 

NAME: I 

*** DESCRIPTIVE INFORMATION ==================================================== 

*** ADDRESS AND TELEPHONE INFORMATION=========================================== 

*** INFORMATION ON OFFICERS ==================================================== 

*** OTHER INFORMATION ========================================================== 

*** RECORD OWNERSHIP INFORMATION================================================ 

STATUS: SI PREVIOUS SUSPECT, CLOSED CASE DATE: 022514 

AGENCY: CKS ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: | (b)(6) ( b)(7> ( ~ j 

TELEPHONE: 972 44 | ' UA 7A^'' I TITLE : 

DATE ENTERED: 052206 LAST UPDATE: 022514 

CASE NUMBER: | (b)(7)(E) | 

REMARKS : 

E-MAIL ADDRESS ASSOCIATED WITH THE REGISTRANT INFORMATION FOR A COMMERICAL CP 
WEBSITE 

*** PRIMARY ACCESS INFORMATION================================================== 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 


Page 124 of 929 



REQUESTED BY : | (b)(6), (b)(7)(C) [ 

OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: | (b)(7)(E) | SUB RECORD 03 


*** IDENTIFYING INFORMATION ==================================================== 

NAMF • I IBHJJ! \& U.S.L. 5 jaiMflj Lniifl victims ana i 

' Ir-hilrt rinh t « M-iUSV ISIISf R ISHOf I 

*** DESCRIPTIVE INFORMATION ==================================================== 

*** ADDRESS AND TELEPHONE INFORMATION=========================================== 

*** INFORMATION ON OFFICERS ==================================================== 

*** OTHER INFORMATION ========================================================== 

FIN ID: DATE: 20 

*** RECORD OWNERSHIP INFORMATION========================>======================== 

STATUS: SI PREVIOUS SUSPECT, CLOSED CASE DATE: 101508 

AGENCY: CBI ICE OI B IRMINGHAM AL NAME: (b)(G) (b)(7)(C) | 

TELEPHONE: 205 2S T un 7A un ''l TITLE: 

DATE ENTERED: 060107 LAST UPDATE: 101508 

CASE NUMBER: | (b)(7)(E) | 

REMARKS : 

EMAIL ACCOUNT RELATED TO A SUBJECT WHO IS ALLEDGEDLY COLLECTING PAYMENTS FOR 
USER ACCESS TO A WEBSITE CONTAINING HUNDREDS OF IMAGES OF CHILD PORNOGRAPHY. 

*** PRIMARY ACCESS INFORMATION=== ============================== ================= 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 


Page 125 of 929 



REQUESTED BY : | (b)(6), (b)(7)(C) | 

OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 


041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: | (b)(7)(E) | SUB RECORD 01 


*** IDENTIFYING INFORMATION =======================================; 

NAMF • I m- iJ- u.s.l. 5 iuu&Tuj urn wuiirui m j i 

'1C. . I rhilrt I.itn.w rinhta fhW-IV 18 I I Q f K -WtlQMS I 

*** DESCRIPTIVE INFORMATION ======================================== 


*** ADDRESS AND TELEPHONE INFORMATION; 


*** INFORMATION ON O 
OFFICER- LAST NAME : 

?FICERS = 

(b)(6), (b)(7)(C) 


FIRST NAME 


MIDDLE NAME: 


*** OTHER INFORMATION =================================================== 


FIN ID: DATE: 20 

*** RECORD OWNERSHIP INFORMATION========= =============================== ==: 

STATUS: SI PREVIOUS SUSPECT, CLOSED CASE DATE: 092211 

AGENCY: CBI ICE OI - BIRMINGHAM AL NAME: | (W) (b)(7),-;., | 

TELEPHONE: 205 29 | | TITLE: 

DATE ENTERED: 080706 LAST UPDATE: 092211 


CASE NUMBER: |~ ~ 


REMARKS : 

EMAIL ACCOUNT ASSOCIATED WITH CHILD PORNOGRAPHY WEBSITES. 

*** PRIMARY ACCESS INFORMATION=========================== 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 

Page 126 of 929 


OFFICIAL USE ONLY 



REQUESTED BY: 



*** RECORD OWNERSHIP INFORMATION== ================ 

STATUS: SI PREVIOUS SUSPECT, CLOSED CASE 

AGENCY: CKS ICE 01 HQ - CHIEF, CYBERSMUGGL NAME : [ 

TELEPHONE: 972 44 | w '7A un " | TITLE : 

DATE ENTERED: 052206 LAST UPDATE: 022514 


CASE NUMBER: 


REMARKS : 

SUBJECT E-MAIL ADDRESS PROVIDED MEMBERS IP INFORMATION FOR A COMMERICAL MEMBER 
ONLY CP WEBSITE KNOWN AS 1,1^ 


*** PRIMARY ACCESS INFORMATION===============; 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 

Page 127 of 929 


OFFICIAL USE ONLY 



REQUESTED BY: 



*** IDENTIFYING INFORMATION ==================================================== 

NAME: S EG PAY 

*** DESCRIPTIVE INFORMATION ==================================================== 

*** ADDRESS AND TELEPHONE INFORMATION= ================================== ======== 

*** INFORMATION ON OFFICERS ==================================================== 

*** OTHER INFORMATION ====«»«——— ■■»==== ======«— «= = = ===========— == = = — ■■■ 


*** RECORD OWNERSHIP INFORMATION===== ============ 

STATUS: NO NON-SUSPECT, OTHER 

AGENCY: CKS ICE OI HQ - CHIEF, CYBERSMUGGL NAME: 
TELEPHONE: 972 44| I TITLE : 


DATE: 052206 


DATE ENTERED: 052206 LAST UPDATE: 090712 


REMARKS : 

CREDIT CARD PAYMENT PROCESSOR BASED IN BOCA RATON FLORIDA AND THE UK; 


PROCESSED PAYMEN T FOR MEMBERSHIP ACCESS TO A COMMERICAL CP WEBSITE KNOWN AS 


*** PRIMARY ACCESS INFORMATION: 
LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 

Page 128 of 929 


OFFICIAL USE ONLY 



REQUESTED BY : | . (6),(t: ?: | 

OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ’ ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: | (b)(7)(E) | SUB RECORD 01 


*** IDENTIFYING INFORMATION ========== 

NAME • I W[iy 14 u 15 L ' 5 JUU ^ U ’ L ™ u ™ 1!! ana ™ IU 1 

iWUIC '’ 1^°°°°°' ""hh. fhOTVia I I q r K -ISnOMS (Floral U.rtim I 

*** DESCRIPTIVE INFORMATION ========== 

*** ADDRESS AND TELEPHONE IN FORMAT ION = 


*** INFORMATION ON OFFICERS ==================================== 

OFFICER- LAST NAME: PUCKETT 

FIRST NAME: ROBERT MIDDLE NAME: 


*** OTHER INFORMATION 


FIN ID: 


DATE: 


20 


*** RECORD OWNERSHIP INFORMATION=================================*========: 

STATUS: SI PREVIOUS SUSPECT, CLOSED CASE DATE: 092211 

AGENCY: CBI ICE 01 - BIRMINGHAM AL NAME: I (b)(6) (b)(7)(C) | 

TELEPHONE: 205 2 9| ,un 7A u ' 1 " I TITLE: 

DATE ENTERED: 073106 LAST UPDATE: 092211 


CASE NUMBER: | (b)(7)(E) 1 

REMARKS : 

INTERNET WEBSITE IS AN ADVERTISING SITE, LEADING ITS VIEWERS TO A MEMBERS 
ONLY SITE, OFFERING HUNDREDS OF IMAGES OF CHILD PORNOGRAPHY. 

*** PRIMARY ACCESS INFORMATION===================================^=======: 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 


OFFICIAL USE ONLY 



REQUESTED BY : | (b)(6), (b)(7)(C) | 

OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: | (b)(7)(E) | SUB RECORD 02 


IDENTIFYING INFORMATION 


*** DESCRIPTIVE INFORMATION 


*** ADDRESS AND TELEPHONE INFORMATION: 


*** INFORMATION ON OFFICERS ============================ 


*** OTHER INFORMATION 


*** RECORD OWNERSHIP INFORMATION=============== ================== ========= 

STATUS: SI PREVIOUS SUSPECT, CLOSED CASE DATE : 022514 

AGENCY: CKS ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: | (b)(6), (b)(7)(C) | 

TELEPHONE: 972 44r un 7A un ' ; I TITLE : 

DATE ENTERED: 062806 LAST UPDATE: 022514 

CASE NUMBER: | (b)(7)(E) | 

REMARKS : 

SUBJECT WEBSITE IS AN ADVERTISING WEBSITE ASSOCIATED WITH THE MEMBER ONLY 
WEBSITE KNOWN AS HOME COLLECTION 


*** PRIMARY ACCESS INFORMATION== ======================== ======================== 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 

Page 130 of 929 


OFFICIAL USE ONLY 



REQUESTED BY: 


(b)(6), (b)(7)(C) 


OFFICIAL USE ONLY 

041816 

TECS RECORD ID: ["~ 


-- TECS II INFORMATION -- OFFICIAL USE ONLY 
TECS II ORGANIZATION SUBJECT ... PAGE 1 

1 SUB RECORD 01 


*** IDENTIFYING INFORMATION ========== 

mjvmf • I IBJUJ: 1 4 u.b.L. 5 J31M0) Lnna victims ana emio witnesses ngms, i 

' I mrs ff-rto r.1 imc' Prntoriinn a nH Pinhl c I 

*** DESCRIPTIVE INFORMATION ========== 

*** ADDRESS AND TELEPHONE I N FORMAT ION = 
*** INFORMATION ON OFFICERS ========== 


MIDDLE NAME: 
MIDDLE NAME: 


*** OTHER INFORMATION ===================================================== 

FIN ID: DATE: 20 

*** RECORD OWNERSHIP INFORMATION===== ================================== === 

STATUS: SI PREVIOUS SUSPECT, CLOSED CASE DATE ; 092211 

AGENCY: CBI ICE 01 - BIRMINGHAM AL NAME: | (b)(6) (b)(7)(C) | 

TELEPHONE: 205 2 9 | I TITLE : 

DATE ENTERED; 073106 LAST UPDATE: 092211 

CASE NUMBER: | (b)(7)(E) | 

REMARKS : 

EMAIL ADDRESS IS RELATED TO A WEBSITE WHICH OFFERS HUNDREDS OF IMAGES OF 
CHILD PORNOGRAPHY. 

*** PRIMARY ACCESS INFORMATION===========================================~ 

LOOKOUT LEVEL: 


OFFICER- LAST NAME: 
FIRST NAME 
OFFICER- LAST NAME: 
FIRST NAME 



OFFICIAL USE ONLY 


TECS II INFORMATION 
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OFFICIAL USE ONLY 



REQUESTED BY : [ bHBMbjt^j ] 

OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: | (b)(7)(E) | SUB RECORD 02 


*** IDENTIFYING INFORMATION ==================================================== 

NAME • I miy 1 4 U.S.L. 5 Juua(U) uiiiu warns win ma mmsisnn i 

^ & ' I rinhf» IhUSV 1 « I I q P K >F 0 H 0 r a l U.rt.ms' Prnto^inn a nH I 

*** DESCRIPTIVE INFORMATION ==================================================== 

*** ADDRESS AND TELEPHONE INFORMATION============================ ? ============== 

*** INFORMATION ON OFFICERS ==================================================== 

*** OTHER INFORMATION ========================================================== 

*** RECORD OWNERSHIP INFORMATION================================================ 

STATUS: SI PREVIOUS SUSPECT, CLOSED CASE DATE: 022514 

AGENCY: CKS ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: | (b>(3>,(b>(7>(C> | 

TELEPHONE: 972 44| | TITLE: 

DATE ENTERED: 062806 LAST UPDATE: 022514 

CASE NUMBER: | (b)(7)(E) | 

REMARKS : 

SUBJECT EMAIL ADDRESS DISTRIBUTES USER NAMES AND PASSWORD TO A CHILD PORN 
MEMBER ONLY WEBSITE; ALSO ASSOCIATED WITH SUPPORT FOR THE SAME MEMBER ONLY 
WEBSITE 

*** PRIMARY ACCESS INFORMATION======================= =========================== 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE - ONLY 


Page 132 of 929 



REQUESTED BY : | ■ ^;(6> = (b>j7>;o;> | 

OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: | (b)(7)(E) | SUB RECORD 01 


*** I DENTIFYING INFORMATION 
NAME: (2 


* 1 S I I q I- K renWHX (FoHoral I 


*** DESCRIPTIVE INFORMATION 


*** ADDRESS AND TELEPHONE I N FORMAT ION = 
*** INFORMATION ON OFFICERS ========== 


*** OTHER INFORMATION ================================================= 


FIN ID: DATE: 20 

*** RECORD OWNERSHIP INFORMATION============================================== 

STATUS: SI PREVIOUS SUSPECT, CLOSED CASE DATE: 092211 

AGENCY: CBI ICE 01 - BIRMINGHAM AL NAME: | (b)(s> (b)(7) ( c> | 

TELEPHONE: 205 29 |' un 7A UA ''l TITLE: 

DATE ENTERED: 073106 LAST UPDATE: 092211 

CASE NUMBER: | (b)(7)(E) | 

REMARKS : 

ACCOUNT RELATED TO A SUBJECT WHO IS ALLEGEDLY INVOLVED IN COLLECTING PAYMENTS 
FOR A MEMBERS ONLY WEBSITE OFFERING HUNDREDS OF IMAGES OF CHILD PORNOGRAPHY. 

*** PRIMARY ACCESS INFORMATION================================================ 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 
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OFFICIAL USE ONLY 



REQUESTED BY : | _.(6), (b)(7)(C) | 

OFFICIAL USE ONLY -- TECS II INFORMATION -- OFFICIAL USE ONLY 
041816 TECS II ORGANIZATION SUBJECT PAGE 1 

TECS RECORD ID: | (b)(7)(E) | SUB RECORD 02 


*** IDENTIFYING INFORMATION ==================================================== 

NAME • I IUJNJ- 1* u.s.l. s Jauafuj uwu mm ana lamu i 

rinh t « M-.U-IV 1 S I I <g T K -jSOQM' (F 0 H 0 r a l I 

*** DESCRIPTIVE INFORMATION ==================================================== 

*** ADDRESS AND TELEPHONE INFORMATION====== ================================== === 

*** INFORMATION ON OFFICERS ==================================================== 

*** OTHER INFORMATION ========================================================== 

*** RECORD OWNERSHIP INFORMATION================================================ 

STATUS: SI PREVIOUS SUSPECT, CLOSED CASE DATE: 022514 

AGENCY: CKS ICE 01 HQ - CHIEF, CYBERSMUGGL NAME: | (b>(6>, ( b>(7>(C> | 

TELEPHONE: 972 44 | Wk 7A un ''l TITLE: 

DATE ENTERED: 062806 LAST UPDATE: 022514 

CASE NUMBER: | (b)(7)(E) | 

REMARKS : 

SUBJECT COMPANY LISTED AS ENTITY THAT OWNS A PAYPAL ACCOUNT THAT HAS ACCEPTED 
PAYMENTS FOR A CHILD PORN MEMBER ONLY WEBSITE. 

*** PRIMARY ACCESS INFORMATION================================================== 

LOOKOUT LEVEL: 


OFFICIAL USE ONLY 


TECS II INFORMATION 
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REQUESTED BY : | (b>(S) ; (b>(7>(c> 1 

OFFICIAL USE ONLY 


DEPARTMENT OF HOMELAND SECURITY 
ICE 


REPORT OF INVESTIGATION 


TITLE ; ' COMMERICAL CP WEBSITE KNOWN AS TK 


TECS ACCESS CODE [[] 


PAGE 1 

CASE NUMBER | (b)(7)(E) 


CASE STATUS: 


INTERIM RPT 


REPORT DATE 

DATE ASSIGNED 

PROGRAM CODE 

REPORT NO. 

081306 

051706 

LEJ 

005 


RELATED CASE NUMBERS: 


COLLATERAL REQ : 


TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 


TOPIC: JULY 21, 2006 PURCHASE AT ADVERTISING WEBSITE 


SYNOPSIS: 

On April 5, 2006, Senior Special Agent (SS/A) Q 


(b)(6) (b)(7)(C) 


^], Immigration and 


Customs Enforcement (ICE), Cyber Crimes Center (C3), Child Exploitation 
Section (CES) , received information from the National Center for Missing and 
Exploited Children (NCMEC) regard ing a co mmercial website offering child 
pornography for sale via cybertip | (b)(7)(E) | . The reported URL was 
I which was kn own as *nSfejS55!![l- " The member only 
w?b^re was krom as TS -jm, ».i an 


(b)(3): 18 U.S.C. § 3509(d) Child victims' and ch 


rights, (b)(3): 18 U.S.C. § 3509(d) (Federal Victims' Protection and Rights Act), (b)(7)(E) 


DISTRIBUTION: 



| (b)(6), (b)(7)(C) | SENIOR SPEC AGENT 



APPROVED : 

| (b)(6>.(b)(7>(C> | ASST DIRECTOR (OI) 

ORIGIN OFFICE : KS 
HQ - CHIEF, CYBER CR 

TELEPHONE : 703 2 9| ' U «7A U/1 " 1 

TYPIST : _ 
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DETAILS OF INVESTIGATION 


On April 5, 2006, Senior Special Agent (SS/A) | (b>(6>,(b>(7>(c> |, Immigration and 

Customs Enforcement (ICE) , Cyber Crimes Center (C3 ) , Child Exploitation 
Section (CES) , received information from the National Center for Missing and 


Exploited Children (NCMEC) regard ing a co mmercial website offering child 
pornography for sale via cybertip I (b)(7)(E) | . The reported URL was 

which was kn own as " EgSSSggl - '' Tha member onl y 
website was known as ' I™ 1 'iiib V™ L T.I . " 


On July 21, 2006, SS/A received information from NCMEC regarding a 

commercial website advertising the sale of child pornography through a member 
restricted website. The advertising website was located at URL; 

and was On the same date. SS/A 

|wm D >| accessed the website at URL: 

,| ms) ia u SU ; 5 3sua \ This 


I ibHJ) l b u b 


sted URL read ''[2 


The title bar of 

iat you've been looking for so 


long ! 11 T he web page contained a collage of approximately eight images 
depicting | , , | . 

The following text appeared on this page: 


"This is what you've been looking for so long!" 

"In our Lolita paradise your sweet dreams will come true. These cute 
innocent angels are posing for you solo and in couples . They are ready to 
show you all their secret desires. So tight, so beaut if u. Fly to paradise 
of orgasm with out little angels." 


"Hello Dear Visitor!" 

"This site will give you the chance to express your inside desires. Huge 
collection of various Lolitas is presented for your evaluation. All rights 
of our content are reserved meaning exlusive and unique models. " 

The site contained three hyperlinks, which redirected SS/EMmi] to three 
additional web pages. The hyperlinks were: "FREE TOUR;" "JOIN;" and 
"MEMBERS. " 


The "FREE TOUR" hyperlink contained the following text: 

"Fresh Lolita Content!" 

"Join us immediately and get much pleasure from viewing our site." 
"15gb of hi-quality Lolita photos" 

"lOgb of amazing video content and more" 


In additi on, the "FREE TOUR" hyperlink contained approximately nine image s 

denicfina (b)(3): 18 U.S.C. § 3509(d) Child victims' and child witnesses' rights (b)(3>:18 U.S.C. § 3509(d) (Federal Victims' Protection and Rights Act) I. 

F — : 5 ■ . I MJ) ! Ih U b.L j> 3bU»(d) Lhi l d victims and child witnesses nghts, (b)(3): I H J.b.L. 

3i1fl0fiji (Ffirlfiffll VirJima' Prnlp.fJinn nnri Rinhta ft i 


Specifically, two of the images depict [ 


The web page contained the same hyperlinks 
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described above. 



addition, this gallery page contained a "JOIN NOW" hyperlink. 


The "JOIN MOW" hyperlink contained one image of I SSSSS - 
The web page also contained the following text: 

"Join to BSSffl 1 
"Our Rules" 

"1. You can view our photo and video works any number of times during your 
membership period" 

"2. You're prohibited to copy, public preview, resell or post to the Usenet 
our material, which is copyrighted. We will track any violation and 
illegal activity and the abusers will be prosecuted to the highest extent 
of law possible 

"3. E-mail us if you have problems subscribing. We appreciate your help." 
"4. All fraudulent transactions will be investigated and prosecuted." 

The webpage also contained a "JOIN NOW" hyperlink, which redirected to a 
payment website entitled "Iwest-online payment processor." The payment web 
page contained a form entitled "User Info, " which required the customer to 
enter their name, e-mail, address, telephone, login, password, and credit card 
information. 


On July 21, 2006, SS/A accessed the join page described above. SS/A 

entered the required information, to include name, addr ess, e -mail, telephone 
number, and credit card information. In addition, SS/A cho se a login and 

password. After completing the required information, SS/A | click ed the 
"secure purchase" button located at the bottom of the web page. SS/A was 

redirected to another web page that displayed the following text: 


"All next additional information you will get on your e-mail in nearest 
time 1 " 

"Please, be patient!" It needs for your safety!" 

"Please note, transaction processing may take up 5 minutes." 

"If you don't receive answer in 5 minutes, please contact us to avoid 
duplicate charges." 


On the same date, SS/A r77/r7’l r eceived an e-mail message from 

The subject line was "Your order confirmation." 
The following text was excerpted from the e-mail: 
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"Recently you made request to i oin I I paysite." 

"You've just went through verification step." 

"Your card wasn't charged." 

"You are in one step from biggest child porno member zone." 

"To complete registration follow instructions." 

"To pay by Credit Card you need to follow these simply instructions: 
open link: 


C 


(b)(3): II 


S.C. § 3509(d) Child 


Id witnesses' rights,(b)(3):18 U.S.C. § 3509(d) (Federal Vi 


Rights Act) 




2. enter your credit card info" 

"3. wait for login on your e-mail." 

"After that you will receive email with login info to our child porno site. 
Thank you for your patience . " 


"Warning 
email 


TB7T57-T! 


For our and 


5 33UU10J L 


your secur ity please email all questions only this 
I) . All emails th 


that will be sent to 


other email addresses will be ignored." 

mm ryrrer IN MOMENT FROM US PLEASE WRITE ANYTHING TO 

I rinhti (himvi 8 M S H J R 3^naVriHFaiternl ^rtmv'^tartinn'nnri I (fastest support) . 

"IF YOU WILL WRITE EMAILS TO ANOTHER ADDRESSES YOU WILL NOT RECEIVE 
ANSWERS! DON'T WRITE ANYTHING ABOUT CP TO OTHER ADDRESSES. THIS IS FOR 

VOT1R f 1 CFrrlCTTV OMTV Tn I (b)(3) IB U S U ^ JbUyfd) Uhild v,d,nS4' i,Sd th.ld -AritrS^iies I „ 
iUUKo bh.UUK.Lir. UWUY 1U | , ltlh rft 1 filler; U^nfliilUFRilRrnlViiama' Ptnlpflmn nnrtl- 


The URL contained the e-mail message redirected to the same PayPal payment web 
page witnessed during the June 23, 2006 purchase (See R OI#003) . The pay ment 
for the child pornography member only website known as IThL was 

facilitated by Financial Services, (BF) , through PayPal's payment platform. 


On July 30, 2006, SS/A 

I (b)(3): 1 8 U S.U ^ 3buH(d) Child victims ' and 'chi l d AiliULVs 1 1 

I tiflhta (htiflV I H 1 1 S n fi 35QSid> (Fgrtgrnl Virtim-i' PmlHtlinn nnr 

e-mail : 


received an e-mail message from 
]. The following text was excerpted from the 


" Members Zone_url: [ 
"login: | (b)(6) ( b)(7)(C)~|'» 
"password: | (b>(B> (b) ( 7) ( c> | ' 


llL)12). la U.S.C. S HSUSId) (Fsdsral Victims' Piatesticn anfl Riahte Ac I 


On or abou t June 31 
located at [. " mv 


acce ssed the member restricted website 
h n« , « . ses . J. The title bar indicted the web page 

ffina/rtUFpriPifpl yirtitnV Prnlprlinn nnrl Rl , . , . . ^ 

nnh?J ~ Secret members area." The member., restricted 


2006, SS/A 
j) 3bliy(d) 


was known as "' j fijSL, . 

website contained the same content and structure as the member restricted 
website accessed during both previous purchases. 

On or about July 31, 2006, SS/A accessed a publicly available service 

located on the Internet to determine the registrant /owner of the domain name 
1 mi** 1 1 11.T I - " Th i s service is a free, commercial database service 

capable of identifying, among other things, the owner of a particular domain 
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name and the IP address where the website is physically located. This 
database search indicated that the IP address associated with the domain name 
"S, 11 EBSSSSS U is owned by A P oll ° Hosting, Inc., 
2303 RR 6320 South, Ste 135-301, Austin, Texas 78734. In addit ion, the 
database search provided t hat the domain name was registered by | (b>(s>,(b>(7>(cT| 

(b)(6) (b)(7)(C) 1 , New York, NY 12345. The e-mail address listed for 

(b)(6), (b)(7)(c) | was | (b)(6), (b)(7)(c) fe yahoo . co . uk . 


On or about July 31, 2006, Trial Attorney Q 


3 . 


__ .S. Department of 

Justice (DOJ) , Child Exploitation and Obscenity Section (CEOS) issued a 
preservation request pursuant to 18 U.S.C. 270 3 (f ) , requesting that Apollo 
Hosting, Inc. preserve the contents of the URL: ] . ™»J° s ™ 
pending issuance of a search warrant. 

Investigation continues . 


Ifinhta mil,-)) Ifj'.i.vr. S msdll (Ffirtfirnl Victims' Prntp.i; 
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CASE NUMBER^ 

1 


REPORT DATE 

DATE ASSIGNED 

PROGRAM CODE 

REPORT NO. 

102506 

051706 
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, 006 


RELATED CASE NUMBERS: 


COLLATERAL REQ : 


TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 


TOPIC : 


£] COMMERCIAL CP PURCHASE 


SYNOPSIS: 

On April 5, 2006, Senior Special Agent (SS/A) | (b)(B> (b)(7)(C) | , Immigration and 

Customs Enforcement (ICE) , Cyber Crimes Center (C3) , Child Exploitation 
Section (CES) , received information from the National Center for Missing and 
Exploited Children (NCMEC) regard ing a co mmercial website offering child 
pornography for sale via cybertip | (b)(7)(E) |. The reported URL was 

[ imy iMJ ^ jBOmdTthi i a ^ ' ms 1 m dhi i cf 1 1 which know n as "I iwf i aubi siiiuam) I .. The member onlv 

wimnimBW.rinhta (h)ffllfi II a r. 6 miM m fFnitar jil jjjj U & lr.h,irt mri rhiiri mtm. 1 ■ ine memDer oni Y 


website was known as 


This report details an undercover purchase at URL: 

(b)(3): I H USU7,_3WJ(d) Child victims artd chi l d witnesses rights (b) ■ - r — ' 


1 1 s r. ii 3508^ ffiadatnUfi 

provided access to 

i Mavmu ijci 


also known as 


The purc hase 

commercial child pornographic member site kftown as " It ,77 71 


a.” 


DISTRIBUTION: 

| signature! 

| (b)(7)(E) | 

| (b)(6) : (b)(7)(C) | SENIOR SPEC AGENT 



| APPROVED : 

| (b)(6).(b)(7)(c> | OI PROGRAM MANAGER 

ORIGIN OFFICE: KS 
HQ - CHIEF, CYBER CR 

TELEPHONE: 703 29T“ A 7A“ A ''I 

TYPIST: r-Hjyi . 
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DETAILS OF INVESTIGATION 


On April 5, 2006, Senior Special Agent (SS/A) | (b>(s>(b)(7>(c> | , Immigration and 

Customs Enforcement (ICE) , Cyber Crimes Center <C3) , Child Exploitation 
Section (CES ) , received information from the National Center for Missing and 
Exploited Children (NCMEC) regard ing a co mmercial website offering child 


W3TR 


wfhwviaiiRn KasnaMWFB 


website was known as 


gjr * as 


" The member only 


r 5 2006, ICE/C3 SS/A (b>(6>, (b)(7>(c> | received an e-mail message from 

wM?RviR g i V i'”n% a ^ g l ; with a subject line of "Taboo underage photos." The 


On Octobe 

HBH3)!l8UB.t'.y35U8ia) 1 

I n,ih!r. liinf 

following text was excerpted from the 


"Very Hot Lolita Portal 
Video" 


Exclusive Content Only Here New Quality Photo and 


Lolitas outdoors," 

Lolitas on the beach, in the country, " 
little girls showing pussies and tight ass," 
little angels dancing and playing with toys, 
little girls posing for cameras" 


I (b)(3); i? V SC, 5 35Q91 1 ?) Pr mv? n 9 n ?l 


title bar stated the following: "Forbidden Dreams become Reality., 1 ; The 


webpaqe contained screenshots for the 

„ ^(b)|J) I o U b L frjbUU(d) 




following advertising websites 

„ „ HB)U) l a i Jb.L 4 J3Uaia)Lm i a i. n ,J (B)(3): IK USU j, 3bU3(d) Lh.ld vidims - 'and I. II |,| 1B)U1 I fa L ' S U SJaua i. I, 

.,.^ jsgr >Tgadvi t ^^ project 

Watchdog; while the other four advertising websites have been linked to the 
I ' 1 investigation ( I (b)(7)(E) | ) . 

On the same d ate, 
redirected to 


tssi 


s/aP™ 1 
b / l $ JauaM ' l™ 


clicked the hygerl ink for 


]. The following text was 


121 121L2J2 f, asoatdl fEadaial Manna: Prnlprlinn nnrl Binbta An) 

excerpted from the webpage : 

"Discover what happened to two 13 y.o. gangtresses when they rushed into the 
Jeweller's shop and threatened a 12 y.o. salesgirl with knives. Find out how 
the salesgirl dealt with the situation." 


"l Hour 555 MB" 


"High Quality Full Length Movie" 
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] is a just released full length movie for real CP lovers. As a 


m'l'.'lyrfT?' iunyi.ll ,..WV J-O. 4-O.i. loni '-*■ 13. no. Oi 

--- - ■ - J Member you can buy this great movie at our special price of $100! The 

Buy it now and get $100 off." 


fTwp 

I R SRnBMS nhilri _ _ 

Retail price (for not members) is $350 


In addition, the webpage displayed approximately eight images d epicting 

(b)(3): 1 8 U.S.C. § 3509(d) Child victims 1 and child witnesses' rights, (b)(3): 18 U.S.C § 3509(d) (Federal Victims' Protection and Rights Act) |. The images 

j. 8 33U»W unna victims ana chna witnesses ngms ; (b)(J) II 1 1 ' 1 

S 3509(4) (Fp.flp.tfll Minima' RratpJtinnjndBinhtaAcfl — - 


depicted | f iar . s rFp.tip.mi viiaimfi 1 Pmtp.uinA Anri Rinhi.i F The webpage also contained 

hvnerlink that redirected to 

|~M?rTgr;. , s.c: sgsog^fiii^gmr^^a 1 ^^ nghb,(bV3yi8 u.ao. s 'Jbuy(d) federal ua , 


■ ,Rmteflim.nnri.Rinhto tat) 


excerpted from the webpage: 


3 The following text was 


"Join to E 




"Our Rules" 

"1. You can view our photo and video works any number of times during your 
membership period." 

"2. You're prohibited to copy, public preview, resell or post to the Usenet 
our material, which is copyrighted. We will track any violation and illegal 
activity and the abusers will be prosecuted to the highest extent of law 
possible . " 

"3. E-mail us if you have problems subscribing. We appreciate your help." 
"4. All fraudulent transactions will be investigated and prosecuted." 


"Payment Center" 

"CLICK HERE TO SUBSCRIBE 99.95$ FOR 1 MONTH" 

"* At payment necessarily write correct e-mail" 

On the same date, SS/A |7™n1 clicked the hyperlink entitled "CLICK HERE," which 

redirected to I lu — > UJ ' U :J|U J u ^ JJUJ|U| " yLiyiai HULyLUU " “"H . The 

title bar on the webpage indicated the following: "billing join." In 
addition, the following text was excerpted: 

" IW iwest, online payment processor" 

"Billing is discrete. We keep all the information you provide to us safe and 
secure on our servers. Your information will never be sold or trader with 
anybody else," 

"Website: I I " 

"Amount: Membership $99.95 for 30 days (no rebill)" 

The webpage was a billing form requesting the following information: full 
name; country; state; city; zip code; address; email address; phone number; 
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and credit card information. The webpa ge also contained the follow ing e-mail 
address tor cancellations and problems : After 

completing the required information, SS/A clicked the "Secure Purchase" 

button, which redirected to 



" ! ! IWarnmg! ! [Remember! ! !" 

"This URL will be open ONLY ONCE! If you are not ready to pay, do not open 
it!" 

"2. Enter your credit card information,-" 

"3. If transaction was accept, you will be receive login information to your 
e-mail in 5-10 min." 

"Thank, you for you patience" 

" ! ! ! Warning !! ! ' 

"If you have any questions or concerns regarding this purchase, please feel 
free to contact our customer support in one of the following ways.-" 

"Online c ustomer service at l~~ rBWTOLIbL °' JbL ^ ] ■■ 

II -j 1 I iDJidj: iou.s.b.9 00U»(d) unira virornsan^nrafnessesli 

oy amaxx | n|lhrfl mmnfi u fjft S 3, ■inarm fFRriRrnl ViUims 1 PrntRUinn nl 

"All emails that will be sent to other addresses will be ignored." 

"Please use ONLY these methods to contact us 1 " 
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"Thank you for you recent purchase of ‘ • 


"Please save this receipt as you may need this information at a later date." 


"Login Members URL 
"Login Username 
"Login Password 


| ib)U) 1 6 u b l >, jBUiJtai Lw i a via i m;. a 
: Innhis imtm ir. i,i ,<r. r. iFpriptni,v 


(b)(6), (b)(7)(C) 


"Note: Copy and Paste Members URL to your favorite web-browser. Please write 
down your Username and Password so you do not lost them." 


"Transaction Number i |(b)(7XE)p 
"Subscription Period : 30 days" 
"Subscription Price : 99.95 USD" 


"If you have any questions or concerns regarding this purchase, please 
free to contact our customer support in one of the following ways:" 


"Online at 
"By Email: 


it. 'J t • 

rinhK fhliS'i IP. 1 1 S f. fi ^nafrl'i fFprlpml Virtim-V Prntprtmn , 


]" 


fell 
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I (b)(3): 1 8 U.S.C. § 3509(d) Child victims' 

' J (bP:IK U.8.U. 8 9b¥(dJ Wild victims I „ 
I am) child witnesses rights ibli^l 15 U S I • 

this organization: 


i child witnesses rights (b)(3) ISUSC § 3509(d) (Federal Victims' Pr otection and Rights Act) J* " and 

A total of five PayPal accounts have been linked to 


(b)(3): 1 8 U.S.C. § 3509(d) Child victims' and child witnesses' 
-ights.(b)(3):18 U.S.C. § 3509(d) (Federal Victims' F’rotection and 
Rights Act), (b)(6), (b)(7)(C) 
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The following subjects have been used for the PayPal purchases: 



Investigation continues. 
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CASE NUMBER | (b)(7)(E) | 


TITLE: COMMERICAL CP WEBSITE KNOWN' " AS I s. | 

I victims and child witnesses’ rights, f I 


CASE STATUS: 


INTERIM RPT 


REPORT DATE 
121206 


DATE ASSIGNED 
051706 


PROGRAM CODE 


ra 


REPORT NO. 
008 


RELATED CASE NUMBERS: 


COLLATERAL REQ : 


TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 


TOPIC: REQUEST FOR NCMEC CRTS COMPARISON 


SYNOPSIS : 

On April 5, 2006, Senior Special Agent (SS/A) Q 
Customs Enforcement (ICE) , Cyber Crimes Center (C3) , Child Exploitation 


3 Immigration and 


Section (CES) , received information from the National Center for Missing and 
Exploited Children (NCMEC) regardi ng a co mmercial website offering child 
pornography for sale via cybertip I (b)(7)(E) |. The reported URL was 

^ «, csg.' *» — »>« «iy 

lYtfflima ,m<Lstaicl.ffliaesasa .unhid' 


website was known as 


This report serves as a request to the National Center for Missing and 
Exploited Children (NCMEC) to have images captured from a commercial child 
pornography website reviewed against the Child Recognition Identification 
System (CRIS) . 


DISTRIBUTION: 

SIGNATURE: 

| (b)(7)(E) | 

| (b)(6), (b)(7)(C) | SENIOR SPEC AGENT 



APPROVED : 

| (b)(6>.(b>(7)(C) | ICE SECTION CHIEF" 

ORIGIN OFFICE: KS 
HQ - CHIEF, CYBER CR 

TELEPHONE: 703 29| 

TYPIST: jiSH 
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OFFICIAL USE ONLY 


DEPARTMENT OF HOMELAND SECURITY 
ICE 

PAGE 3 


CASE NUMBER”! (b)(7)(E) T 

REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: 008 


DETAILS OF INVESTIGATION 


3 Immigration and 


On April 5, 2006, Senior Special Agent (SS/A) | (b)(6), o 

Customs Enforcement (ICE) , Cyber Crimes Center (C3) , Child Exploitation 
Section (CES) , received information from the National Center for Missing and 
Exploited Children (NCMEC) regard ing a co mmercial website offering child 
pornography for sale via cybertip I (b)(7)(E) I. The reported URL was 

f (bin): IK O.y.u/i Mjy(d) Child ViifliW and dhlld — I . • , 1 ! 1 i BIMl i a i m i \ iBUHiai I „ „ . , 

Wrinht, fhwavm US n s which^ was^^ known as The member only 


website was known as 


C3/CES initiated an investigation into the individual (s) resp onsib le for 
operating t he commercial child pornographic website known as " |j '^1 

I 1 . 11 Since initiation, information has been developed that the same 

criminal organization is operating the following commercial child pornography 
websites : 


(b)(3): 18 U.S.C. § 3509(d) Child victims 1 and 
child witnesses' rights, (b)(3): 1 8 U.S.C. § 3509 
(d) (Federal Victims' Protection and Rights 
Act) 


On October 12, 2006, SS/A | iB ,^/A B| l received information from NCMEC rega rding a 
commercial website of ferinq child pornography for sale via cybertip I (b)(7)(E) |. 

,p. „ rim . KWW 1 B ' U"S I U. >, 3bU9(d) LTO^R r' SSg chi l Jwitnlsses ' rights. I I , hu7ur , I 

The reported URL was | |fi , , s lf y ll3im ^ to lfi flituiniiii.R 1 niiiJ- | (b>(6>, (b)(7)(C), (b)(7)(E) | 


(b)(3): 1 8 U.S.C, § 3509(d) Child victims' and child witnesses' rights, (b)(3): 18 U.S.C. § 3509(d) (Federal Victims' Protection 
(b)(3): 1 8 U.ij. l J. ^ 3bU l j(d) Child victims ' and chi l d witnesses ' rights, (b)(3): 1 8 l~ 

• ", aonaiil) (Frnlmnl Viiaimfi' Prnlnrtinn mil F.mhlfi Afl) I • 


Rights Act), (b)(7)(E) 

On or about the same date, SS/A 


accessed the member only website. The website contained the following 
sections: "Main Page;" "Photos;" "Video;" "Software; 11 "Msg Board;" and 
"Support." There were approximately 18,146 images files in the "Photos" 
section . 


C3/CES requests that the provided image files be run against the NCMEC Child 
Recognition Identifica tion System (CRIS) . The password for the zip file is 
» | (b)(7)(E) | . 11 A ny new information developed related to the victims 

should be forwarded to SS/A r,^°A u; h 

Senior Special Agent I (b>(6), (b)(7)(C) | 

ICE/C3/CES 

11320 Random Hills Road, Suite I 1 // 1 , 0 /! 
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DEPARTMENT OF HOMELAND SECURITY 

PAGE 4 

ICE 



CASE NUMBER | (b)(7)(E) f 

REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: 008 


Fa ir f ax7 VA 22030 
(703) 2 9T™*I 

| (b)(6), (b)(7)(C) | 


Investigation continues. 
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OFFICIAL USE ONLY 


DEPARTMENT OF HOMELAND SECURITY 
ICE 

REPORT OF INVESTIGATION 

TECS ACCESS CODE g] 

PAGE 1 

CASE NUMBER I (b)(7)(E) | 

TITLE: COMMERICAL CP WEBSITE KNOWN AS 

L § t-niicT"! 

Ill witnfiBSRS- rinhts 1 

CASE STATUS: INTERIM RPT 


REPORT DATE 

DATE ASSIGNED 

PROGRAM CODE 

REPORT NO. 

121206 

051706 

ra 

009 


RELATED CASE NUMBERS: 


COLLATERAL REQ: 


TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 


TOPIC: REQUEST FOR NCMEC CRIS COMPARISON FOR WEBSITE 


SYNOPSIS : 


On April 5, 2006, Senior Special Agent {SS/A) Q 


3 Immigration and 


Customs Enforcement (ICE) , Cyber Crimes Center (C3) , Child Exploitation 
Section (CES) , received information from the National Center for^Missing and 
Exploited Children (NCMEC) regard ing a co mmercial website offering child 
pornoqraphy for sale via cybertip I (b)(7>(E> |. The reported URL was 

I (bM l «T ) 3Bt)»(d) Chi l d virtms and chi l d I whirh Wa TTnOWn 3 q J |L|l jfl 4 U S L 4 JUUUIU> I „ Th - mGmber Qnlv 

hritnnaam-finhta ftrtfnvin uso s aanaiiL iFBriBffli Vic If , ■ vn ?nn., .° 3 Irjmri ymm-i mu rhdri Mined- ine ™emoer only 

webs 1 te was known as g 1 . " 


This report serves as a request to the National Center for Missing and 
Exploited Children (NCMEC) to have images captured from a commercial child 
pornography website reviewed against the Child Recognition Identification 
System (CRIS) . 


DISTRIBUTION: 

SIGNATURE: 

| (b)(7)(E) | 

| (b)(6), (b)(7)(C) | SENIOR SPEC AGENT 


APPROVED : 

| (b)(6), (b)(7)(C) | ICE SECTION CHIEF 

ORIGIN OFFICE: KS 
HQ - CHIEF, CYBER CR 

TELEPHONE: 703 2 91 wi-mwi-i | 

typistTT?™! 
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OFFICIAL USE ONLY 


DEPARTMENT OF HOMELAND SECURITY 
ICE 


REPORT OF. INVESTIGATION 
CONTINUATION 


REPORT NUMBER: 009 


DETAILS OF INVESTIGATION 


On April 5, 2006, Senior Special Agent (SS/A) | (b)(SMb)(7HC) | , Immigration and 

Customs Enforcement (ICE), Cyber Crimes Center (C3), Child Exploitation 
Section (CES) , received information from the National Center for Missing and 
Exploited Children (NCMEC) regard ing a co mmercial website offering child 
pornography for sale via cybertip | (b)(7)(E) | . Th e reported URL was 


which was known as 


The member only 


C3/CES initiated an investigation into the individual (s) resp onsibl e for 
op era t i ng t he commercial child pornographic website known as V B | 

11 Since initiation, information has been developed that the same 
criminalorganization is operating the following commercial child pornography 
websites : 


(b)(3): 18 U.S.C. § 3509(d) Child victims' and 
child witnesses' rights, (b)(3): 1 8 U.S.C. § 3509 
(d) (Federal Victims' Protection and Rights 


On October 5, 2006, SS/A received informa tion an e-mail message 

advertising child pornography for sale via URL LL 1 /,';/ , I 
The title bar stated the following: "Forbidden Dreams become Reality, 
webpage contained screenshots for the following advertising websites : 



n or aoouc . . | 

accessed the member only website. The website contained the following 
sections: "News;" "Photos;" "Videos;" "Software;" "Message Board," and "Cancel 
or Rebill. " There were approximately 9,442 image files in the "Photos" 
section. 

C3/CES requests that the provided image files be run against the NCMEC Child 
Recognition Identif ication System (CRIS) . The password for the zip file is 
"I (b)(7)(E) |. " Any new in formation developed related to the victims 

should be forwarded to SS/A | (b / 7 \/p\ b> | : 
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Investigation continues. 
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ICE 


TECS ACCESS CODE [J] 

REPORT OF 

INVESTIGAT 

ION 

PAGE 1 




CASE NUMBER 1 53™=) T 






TITLE: COMMERICAL CP WEBSITE KNOWN AS 1 

CASE STATUS: 

INTERIM RPT 




REPORT DATE 
121206 

DATE ASSIGNED 
051706 

PROGRAM CODE 

ra 

REPORT NO. 
010 

| RELATED CASE NUMBERS: | (b)(7)(E) 









COLLATERAL REQ: 

TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 


I 


TOPIC: REQUEST FOR NCMEC CRIS COMPARISON FOR" Lffff ^ ^TT mEMBER SITE " 


3 Immigration and 


SYNOPSIS: 

On April 5, 2006, Senior Special Agent (SS/A) | wts) (b)(7)(C) 

Customs Enforcement (ICE) , Cyber Crimes Center (C3) , Child Exploitation 
Section (CES) , received information from the National Center for Missing and 
Exploited Children (NCMEC) regardi ng a co mmercial website offering child 


pornoqraphv for sale via cybertip I (b)(7)(E) |. The reported URL was 

| WW 'S ' O s i*W) Chi l d vict i ms and chi l d I which 3- »'l~ IW T tUS ' ~ " " 

Ltn PMP . rinhts <M«\ lailSCS 3Rnfl/rK IFPriPipl y^l WnlC “ Wa - KnOWtl ' 


website was known as 


3 " 


J " The member only 


This report serves as a request to the National Center for Missing and 
Exploited Children (NCMEC) to have images captured from a commercial child 
pornography website reviewed against the Child Recognition Identification 
System (CRIS) . 


DISTRIBUTION: 

SIGNATURE: 

| (b)(7)(E) | 

| (b)(6), (b)(7)(C) | SENIOR SPEC AGENT 



APPROVED : 

1 1 ICE SECTION CHIEF 

ORIGIN OFFICE: KS 
HQ - CHIEF, CYBER CR 

TELEPHONE: 703 29l'“ A “& w "l 

TYPIST : |>™l 
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OFFICIAL USE ONLY 


DEPARTMENT OF HOMELAND SECURITY 
ICE 


REPORT OF INVESTIGATION 
CONTINUATION 


~ CASE NUMBER [_ 


REPORT NUMBER: 010 


DETAILS OF INVESTIGATION 


~"|, Immigration and 
Child Exploitation 


On April 5, 2006, Senior special Agent (SS/A) | (bX6),(bpxc) 

Customs Enforcement (ICE) , Cyber Crimes Center (C3) , 

Section (CES) , received information from the National Center for Missing and 
Exploited Children {NCMEC) regard ing a co mmercial website offering child 

iLtMaaaal pabta mzuz ii&C, R aaBfttt IF °' 

website was known as 


pornography for sale via cybertip I (b)(7)(E) 

| (b)(3): lirtj.U.L' b uaiiyfdj Uhild victims' and child 1 , ,v, 4 


s^known as "[ 


The repo rted URL was 

III WW' 


2 • " The member only 


C3/CES initiated an investigation into the individual (s) resp onsib le for 
operating the commercial child pornographic website known as " Ij 1 ^ V°| 

I I - 11 Since initiation, information has been developed that the same 

criminal organization is operating the following commercial child pornography 
websites : 


(b)(3): 18 U.S.C. § 3509(d) Child victims' and 
child witnesses’ rights, (b)(3): 1 8 U.S.C. § 3509 
(d) (Federal Victims 1 Protection and Rights Act) 


On October 2, 2006, SS/A received information from NCMEC regar ding a 

commercial website offering child pornography for sale via cybertin I (b)(7)(E) |. 
The reported URL was | n ' n b hJ, i i h l ,M:i;lMsr^ IJ K'T.inqr'^ I' |' 


(b)(3): 18 U.S.C. § 3509(d) Child victims' and child witnesses' rights, (b)(3): 18 U.S.C. § 3509(d) (Federal Victims' Protection and Rights Art), (b)(7)(E) 


On or about the same date, SS/A accessed 


the member only website, 
member only website. 


There were approximately 5,558 images files in the 


C3/CES requests that the provided image files be run against the NCMEC Child 
Recognition Identificat ion System (CRIS) . The password for the zip file is 
' 1 (b)(7)(E) | . " Any new inform ation developed related to the 

victims should be forwarded to SS/A 

Senior Special Agent | (bxs) (b)(7)(C) | 

ICE/C3/CES 

11320 Random Hills Road, Suite 
Fairfax, VA 22030 
( 703 ) 2 9 | 
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REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: 010 


(b)(6), (b)(7)(C) 


Investigation continues . 
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REQUESTED BY : | (b)(6), (b)(7)(C) ~| 

OFFICIAL USE ONLY 


DEPARTMENT OF HOMELAND SECURITY 
ICE 


REPORT OF INVESTIGATION 


TECS ACCESS CODE 1 


CASE NUMBER [_ 


TITLE: COMMERICAL CP WEBSITE KNOWN AS 1 I j 

CASE STATUS: 

INTERIM RPT 



REPORT DATE 

DATE ASSIGNED 

PROGRAM CODE 

REPORT NO. 

012407 

051706 

Ed 

Oil i 

RELATED CASE NUMBERS : LIS 1 

COLLATERAL REQ: 

TYPE OF REPORT; 




INVESTIGATIVE FINDINGS 

1 



NCMEC NCVIP ANALYSIS 



SYNOPSIS; 

On April 5, 2006, Senior Special Agent (SS/A) Q 


(b)(6) (b)(7)(C) 

Customs Enforcement (ICE) , Cyber Crimes Center (C3) 


1 Immigration and 
Child Exploitation 


Section (CES) , received information from the National Center for Missing and 
Exploited Children {NCMEC) regardi ng a c ommercial website offering child 
pornography for sale via cybertip I ("wxe) |. The reported URL was 

as ' BSSSB " The member only 

websltewas Known as " I g '.t; ill l’"’'" I'tH . 11 


This report serves as a request to the National Center for Missing and 
Exploited Children (NCMEC) to have images captured from a commercial child 
pornography website reviewed against the Child Recognition Identification 
System (CRIS) . 


nTSTRTRtJTTONr 

1 SIGNATURE: . 

| (b)(7)(E) | 

| (b)(6), (b)(7)(C) | SENIOR SPEC AGENT 


__ _ __ _ ___ _ __ _ 

APPROVED : 

! 1 (b)(6), (b)(7)(C) | ICE SECTION CHIEF 

ORIGIN OFFICE: KS 
HQ CHIEF, CYBER CRIM 

TELEPHONE: 703 29I' U '7A UA "I 

TYPIST: I'm'n'l 
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REPORT NUMBER: Oil 


CASE PROGRAM CODES: 
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DEPARTMENT OF HOMELAND SECURITY 

PAGE 3 

ICE 



CASE NUMBER | (b)(7)(E) | 

REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: Oil 


DETAILS OF INVESTIGATION 


On April 5, 2006, Senior Special Agent (SS/A) | (b>(6> (b)(7)(C) |, Immigration and 

Customs Enforcement (ICE), Cyber Crimes Center (C3), Child Exploitation 
Section (CES) , received information from the National Center for Missing and 


Exploited Children (NCMEC) regard ing a co mmercial website offering child 
pornocrraphv for sale via cvbertip I (b)(7)(E) |. The reported URL was 

IlS. J, Which was kn own as E SSgl ■ " The member only 

website was known as ’ ‘ ' 


U S U . 4 3bUa(d) UMd I 


C3/CES initiated an investigation into the individual (s) resp onsibl e for 
operating t he commercial child pornographic website known as '“I 
I 1 . 11 Since initiation, information has been developed that the same 

criminal organization is operating the following commercial child pornography 
websites : 


(b)(3): 18 U.S.C. § 3509(d) Child victims 1 and 
child witnesses' rights, (b)(3): 1 8 U.S.C. § 3509 
(d) (Federal Victims' Protection and Rights Act) 


On October 23, 2006, SS/A received information from NCMEC rega rding a 

commercial website offering child pornography for sale via cybertip I (b>(7 » E> I . 

The title bar stated the following: "Hot Girls Photos." On the same date , 

(b)(6), (b)(7)(C), (b)(7)(E) 

mJl . Id U 3 C Ll L I . — On or about the same date, SSM Ffa?! 
accessed the member only website. There were approximately 12,115 image files 
and 22 video files in the member restricted website. 

C3/CES requests that the provided image files be run against the NCMEC Child 
Recognition Identification System (CRIS) . The password for the zip file is 
I (b)(7)(E) | . " A ny new 

information developed related to the victims should be forwarded to SS/A [™^J: 

Senior Special Agent I (b)(s> (b)(7)(C) | 

ICE/C3/CES 

11320 Random Hills Road, Suite 1)^,1 
Fairfax, VA 22030 
(703) 29 l w ™ ;) l 
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REPORT NUMBER: Oil 


(b)(6), (b)(7)(C) 


Investigation continues. 
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REQUESTED BY : | (b)(6), (b)(7)(C) | 

OFFICIAL USE ONLY 


DEPARTMENT OF HOMELAND SECURITY 
ICE 

REPORT OF INVESTIGATION 

TECS ACCESS CODE g] 

PAGE 1 

CASE NUMBER | (b)(7)(E) | 


L 5 jouy(a) Lhiid - 1 
Id witnpssps rinhts 1 


REPORT DATE 
051407 

DATE ASSIGNED 
051706 

PROGRAM CODE 

ra 

REPORT NO. 
013 

RELATED CASE NUMBERS: I (b)(7)(E) | 

COLLATERAL REQ : 


TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 


TOPIC: PROJECT FLICKER - SUBSCRIBER LEAD DISSEMINATION - DOMESTIC 


SYNOPSIS': 

In April 2006, the Immigration and Customs Enforcement (ICE) , Cyber Crimes 
Center (C3) , Child Exploitation Section (CES) initiated an investigation into 
a criminal organization operating a commercial child pornography website 
known as " I..77 Z " The investigation has revealed that the same 
organization is operating numerous commercial child pornography websites. In 
addition, the organization utilizes various PayPal accounts to process the 
payments for access to the member restricted websites. The investigation is 
being worked jointly with ICE/C3/CES, ICE/RAC/Birmingham, the U.S. Postal 
Inspection Service, the U.S. Department of Justice (DOJ) , Child Exploitation 
and Obscenity Section (CEOS), and the United States Attorney's Office (USAO) 
for the Northern ni strict of Alabama. ICE has designated this operation as 
PROJECT FLICKER ( ng, 7| | ) . 


This ROI will serve to disseminate subscriber leads to ICE SAC offices. 


DISTRIBUTION: 

SIGNATURE: 

] (b)(6), (b>(7>(C> | SENIOR SPEC AGENT 

(b)(7)(E) 

APPROVED : 

| (b)(6), (b)(7)(C) | ICE SECTION CHIEF 


ORIGIN OFFICE: KS 
HQ CHIEF, CYBER CRIM 

TELEPHONE: 703 2 91 1 

TYPIST: I7STI 
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REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: 013 


In April 2006, the Immigration and Customs Enforcement (ICE) , Cyber Crimes 
Center (C3) , Child Exploitation Section (CES) initiated an investigation into 
a crimina l organization op erating a commercial child pornography website 
known as ^ I . " The investigation has revealed that the same 

organization is operating numerous commercial child pornography websites. In 
addition, the organization utilizes various PayPal accounts to process the 
payments for access to the member restricted websites. The investigation is 
being worked jointly with ICE/C3/CES, ICE/RAC/Birmingham, the U.S. Postal 
Inspection Service, the U.S. Department of Justice (DOJ) , Child Exploitation 
and Obscenity Section (CEOS), and the United States Attorney's Office (USAO) 
for the Northern Dis trict of Alabama. ICE has designated this operation as 
PROJECT FLICKER . 


(b)(7)(E) | 

(b)(7)(E) | . The investigation has 

identified that a specific criminal organization is operating over 18 
different commercial child pornography advertising websites which provide 
access to over 18 child pornography member restricted websites. This 
criminal organization has utilized a specific and identifiable payment 
website known as "iWest." The information developed during the course of the 
investigation has identified that the organization (1) uses various PayPal 
accounts to facilitate the customer payments, (2) uses specific subject 
identifiers within the PayPal accounts to identify purchases into the various 
member restricted websites, and (3) uses specific administrative e-mail 
accounts that are used to distribute access to the member restricted 
websites. The following member restricted websites and associated subject 
identifiers have been identified through undercover purchases: 



brings together financial industry members, NCMEC, and federal law 

enforcement ag encies with the goal of eradicating commercial child 

exploitation . | (b)(7)(E) 1 

| (b)(7)(E) | . 

The investigation has identified a group of individuals within the U.S. that 
own and control numerous PayPal accounts. The PayPal accounts are being 
utilized to facilitate the customer payments for the above listed child 
pornography websites. As discussed above, the owners of the PayPal accounts 
use specific subject identifiers to indicate which member restricted website 
the customer has purchased access to. Project FLICKER has generated 
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082907 

051706 


015 


RELATED CASE NUMBERS: KbW7WE> j" 


COLLATERAL REQ: 


TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 


TOPIC: EXPLANATION OF THE SUBSCRIBER LEAD SPREADSHEET 



SYNOPSIS: 

On April 5, 2006, Senior Special Agent (SS/A) Q 
Customs Enforcement (ICE) , Cyber Crimes Center 
Section (CES) , received information from the National Center for Missing and 
Exploited Children (NCMEC) regard ing a co mmercial website offering child 


(b)(6), (b)(7)(C) 


1 Immigration and 
Child Exploitation 


pornography for sale via cybertip | (b)(7)(E) |. The reported URL was 
-j which was known a s ' ,r: '> l!; ' ! !! I “ 1 


1 r,i imhi;. iliii.'l) in LJ M S Miiiili II Ml.il, II Vu:r r 
only website was known as "[ 


3 - 


The member 


This report provides a explanation of the subscriber lead spreadsheet . 
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REPORT NUMBER : 015 


DETAILS OF INVESTIGATION 


On April 5, 2006, Senior Special Agent (SS/A) I (b>(6>(b>(7>(c> | . Immigration and 

Customs Enforcement (ICE) , Cyber Crimes Center (C3) , Child Exploitation 
Section (CES) , received information from the National Center for Missing and 


Exploited Children (NCMEC) regardi ng a co mmercial website offering child 
pornography for sale via cybertip I (b)(7)(E) | . The reported URL was 

ESSmSSjil ' , a s " The member 

only website was known as " BS S55ZS3 - 11 


The purpose of this document is to provide a detailed explanation of the 
various columns in the Flicker subscriber lead spreadsheets. The’ 
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Investigation continues. 
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CASE STATUS: 
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REPORT NO. 
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RELATED CASE NUMBERS: | 

— 1 


COLLATERAL REQ 





TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 


TOPIC: CLARIFICATION TO ROI #15 AND THE AGAC SUMMARY DOCUMENT 


SYNOPSIS : 

On April 5, 2006, Senior Special Agent (SS/A) Q 


3 Immigration and 


Customs Enforcement {ICE) , Cyber Crimes Center (C3) , Child Exploitation 
Section (CES) , received information from the National Center for Missing and 
Exploited Children (NCMEC) regardi ng a co mmercial website offering child 
pornoqraphy for sale via cybertip I (b)(7)(E) |. The reported URL was 
[ {Bfl s p s rrei: abW(d) iTh.i jv . arm"Sria w< r- | vnn,.,n „ r 


iim-V) irrn k rtbiwiMV in 

"nBaflfifl 1 rinhN IK 11 S C. S fFpriRml Vir.l' 

nly website was kn 


]. " The member 


only website was known 

This report will clarify the explanation for one of the columns contained in 
the spreadsheet. 
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On April 5, 2006, Senior Special Agent {SS/A) | (b)(7)(E) Immigration and 

Customs Enforcement (ICE) , Cyber Crimes Center (C3) , Child Exploitation 
Section (CES) , received information from the National Center for Missing and 


Exploited Children (NC'MEC) regard ing a co mmercial website offering child 
pornography for sale via cybertip I (b)(7)(E) | . The reported URL was 


which was known a s 


only website was known as 


(b)(7)(E) 
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Investigation continues. 
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INTERIM RPT 



REPORT DATE 

DATE ASSIGNED 

PROGRAM CODE 

REPORT NO. 

112007 

051706 


017 

RELATED CASE NUMBERS: | (b)(7)(E) | 


COLLATERAL REQ : CAFE 


TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 
/ COLLATERAL REQUEST / IN 


TOPIC: INFORMATION DISSEMINATION TO BELARUS 


In April 2006, Immigration and Customs Enforcement (ICE), Cyber Crimes Center 
(C3) , Child Exploitation Section (CES) , initiated an investigation into an 
international criminal organization operating numerous commercial child 
exploitation websites. The investigation has been titled Project Flicker. 

The investigation is currently being worked by ICE/C3/CES, ICE/Resident 
Agent -in- Charge (RAC) Birmingham, the U.S. Postal Inspection Service (USPIS) , 
the Federal Bureau of Investigation (FBI), the United States Attorney's 
Office for the Northern District of Alabama, and the Department of Justice 
(DOJ) Child Exploitation and Obscenity Section (CEOS) . 


This report will document a meeting that occurred in Kyiv, Ukraine on October 
22, 2007 and provide dissemination of certain information to Belarus. 
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DETAILS OF INVESTIGATION 


In April 2006, Immigration and Customs Enforcement (ICE), Cyber Crimes Center 
(C3) , Child Exploitation Section (CES) , initiated an investigation into an 
international criminal organization operating numerous commercial child 
exploitation websites. The investigation has been titled Project Flicker. 

The investigation is currently being worked by ICE/C3/CES, ICE/Resident 
Agent -in -Charge (RAC) Birmingham, the U.S. Postal Inspection Service (USPIS) , 
the Federal Bureau of Investigation (FBI), the United States Attorney's 
Office for the Northern District of Alabama, and the Department of Justice 
(DOJ) Child Exploitation and Obscenity Section (CEOS) . 

Project Flicker has identified a criminal organization that is operating in 
excess of 150 different member restricted child exploitation websites. The 
criminal organization e mployed various PayPal accounts to process th e monthly 
subscription payments. I (b)(7)(E) | 


(b)(7)(E) 


In August 2007, Special Agent T (b>(G> tb>(7xc> 1 of the F BI Innocent Images Unit 
was contacted by Warrant Officer (WO) I (b)(6), (b)(7)(C) | of the Ministry of 

Internal Affairs of Ukraine. WO | (b>(6>.(b>(7>(c> | had been contacted by Senior 
Detective | (b>(G> (b>(7>(c> | of the Ministry of Internal Affairs of Belarus. SD 
explained that his office initiated an investigation into a criminal 
organization operating mu ltiple co mmerci al chi ld exploitation websites. The 
discussion between the SA | (b>(G> (b)(7)(C) | and SD I l 7-SuA L 'H indicated that the Belarusian 
investigation was targeting the same organization identified in Project 
Flicker . SA | | requested specific assistance from the FBI and ICE. SA 

| (b)(6), (b)(7)(c) | arranged a meeting in Kyiv, Ukraine for October 2007 to discuss the 
two investigations and see how all parties could benefit from information 
sharing . 

On October 22, 2007, a meeting was held at the U.S. Embassy in Kyiv, Ukraine. 
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The topic of the meeting was the U.S. investigation titled Project Flicker 
and the Belarusian investigation titled Operation Tornado. The following 
individuals were present at the meeting: 


Senior Specia l Agent C 
Section Chief I mmi 
Special Agent 


(b>(6), (b)(7)(C) | , ICE/C3/CES 

_J, ICE/C3/CES 


Supervisory S pecial AgentT 
Special Agent 
Special Agent 
Deputy Chief , 

Senior Detective \~ 


~|, FBI/IIU 


], FBI/IIU 


Drug Enforcement Administration 
FBI 

1, Hig h Tech Crime Department of the MIA/Belarus 

(b)(6), (b)(7)(c) I, Hi gh Tech Crime Department of the MIA/Belarus 
Warrant Officer | (b)(6), (b)(7)(C) ~| , MIA/Ukraine 


3 MIA/Ukraine 


MIA/Ukraine 


SD | wl 7/° n/) | provided that his office has identified at least seven individuals 
that will be arrested. These individuals have senior roles in the cr iminal 
organization being targeted by Project Flicker/Operation Tornado. SD | |b)(b ,n\ b)r7 1 
provided the following names : 


(b)(6), (b)(7)(C) 


SA requested information from the FBI and ICE regarding the U.S. PayPal 

accounts that facilitated the majority of the monthly subscription paym ents 
for the child exploitation member restricted websites. In addition, SA | W> °/A U,> '1 

(b)(7)(E) 


The overall goal of both investigations is to dismantle the criminal 
organization responsible for the commercial child exploitation websites. All 
parties agreed to continue their cooperative efforts and share information 
developed during the investigation. 

SSA | (b)(6), (b)(7)(c) |, Attache F rankfurt , was fully briefed on the results of the 
meeting. In addition, SSA I | agreed to facilitate any future exchanges 

of information between the U.S. and Belarus /Ukraine . 

As a result of the meeting, the FBI and ICE prepared the information 
OFFICIAL USE ONLY 

THIS DOCUMENT IS LOANED TO YOU FOR OFFICIAL USE ONLY AND REMAINS THE PROPERTY 
OF THE DEPARTMENT OF HOMELAND SECURITY, ICE. ANY FURTHER REQUEST FOR 
DISCLOSURE OF THIS DOCUMENT OR INFORMATION CONTAINED HEREIN SHOULD BE REFERRED 
TO ICE HEADQUARTERS TOGETHER WITH A COPY OF THE DOCUMENT. 


Page 185 of 929 






OFFICIAL USE ONLY 


DEPARTMENT OF HOMELAND SECURITY 
ICE 

PAGE 5 

REPORT OF INVESTIGATION 

CAS~E NUMBER 1 (b)(7)(E) f 

CONTINUATION 

REPORT NUMBER: 017 


req uested b y SD I The information fr om both agencies will be sent to 

SSA I | for further dissemination to SD | wt °/A un/ 1 - It is requested that SSA 

| | prepare a formal transmittal and forward the information to SD I I - 


ICE/CE/CES will forward the following information to SSA[^™3: 


(b)(6), (b)(7)(C), (b)(7)(E) 
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(b)(6), (b)(7)(C), (b)(7)(E) 


Investigation continues. 
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RELATED CASE NUMBERS: 


COLLATERAL REQ: 


TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 


TOPIC: DISSEMINATION OF FLICKER LEADS TO C 


SYNOPSIS : 

In April 2006, the Immigration and Customs Enforcement (ICE), Cyber Crimes 
Center {C3) , Child Exploitation Section (CES) initiated an investigation into 


a c riminal organizat ion operating a commercial child pornography website known 
as ■ v l , !!Sn . 11 The investigation has revealed that the same 

organization is operating numerous commercial child pornography faebsites. In 
addition, the organization utilizes various PayPal accounts to process the 
payments for access to the member restricted websites. The investigation is 
being worked jointly with ICE/C3/CES , ICE/RAC/Birmingham, the U.S. Postal 
Inspection Service, the Federal Bureau of Investigation (FBI), the U.S. 
Department of Justice (DOJ) , Child Exploitation and Obscenity Section (CEOS) , 
and the United States Attorney's Office (USAO) for the Northern . rest rict of 
Alabama. ICE has designated this operation as PROJECT FLICKER ( | \ . 


This ROI will serve to disseminate subscriber leads to | wig) ( b)(7)(C) | . 
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REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: 018 


DETAILS OF INVESTIGATION: 


In April 2006, the Immigration and Customs Enforcement (ICE) , Cyber Crimes 
Center (C3), Child Exploitation Section (CES) initiated an investigation into 
a c riminal organi zat ion operating a commercial child pornography website known 
as IT., I . " The investigation has revealed that the same 

organization is operating numerous commercial child pornography websites. In 
addition, the organization utilizes various PayPal accounts to process the 
payments for access to the member restricted websites. The investigation is 
being worked jointly with ICE/C3/CES, ICE/RAC/Birmingham, the U.S. Postal 
Inspection Service, the Federal Bureau of Investigation (FBI), the U.S. 
Department of Justice (DOJ) , Child Exploitation and Obscenity Section (CEOS) , 
and the United States Attorney's Office (USAO) for the Northern Dis trict of 
Alabama. ICE has designated this operation as PROJECT FLICKER OO . 


The investigation has identified a group of individuals within the U.S. that 
own and control numerous PayPal accounts. The PayPal accounts are being 
utilized to facilitate the customer payments for the child exploitation 
websites. As discussed above, the owners of the PayPal accounts use specific 
subject identifiers and Item ID numbers to indicate which member restricted 
website the customer has purchased access to. 
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PROGRAM CODE 

REPORT NO. 
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RELATED CASE NUMBERS: | (b)(7)(E) 


COLLATERAL REQ: 

“toe^'WportT 

INVESTIGATIVE FINDINGS 


TOPIC: INFORMATION RECEIVED FROM BELARUS 

synopsis”! 

In April 2006, Immigration and Customs Enforcement (ICE), Cyber Crimes Center 
(C3 ) , Child Exploitation Section (CES) , initiated an investigation into an 
international criminal organization operating numerous commercial child 
exploitation websites. The investigation has been titled Project Flicker. 

The investigation is currently being worked by ICE/C3/CES, ICE/Resident 
Agent- in-Charge (RAC) Birmingham, the U.S. Postal Inspection Service (USPIS) , 
the Federal Bureau of Investigation (FBI), the United States Attorney's 
Office for the Northern District of Alabama, and the Department of Justice 
(DOJ) Child Exploitation and Obscenity Section (CEOS) . 

This report will document investigative information provided by the Ministry 
of Interior Affairs of Belarus and the Federal Bureau of Investigation. 
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DETAILS OF INVESTIGATION 


in April 2006, Immigration and Customs Enforcement (ICE), Cyber Crimes Center 
(C3) , Child Exploitation Section (CES) , initiated an investigation into an 
international criminal organization operating numerous commercial child 
exploitation websites. The investigation has been titled Project : Flicker . 

The investigation is currently being worked by ICE/C3/CES, ICE/Resident 
Agent -in- Charge (RAC) Birmingham, the U.S. Postal Inspection Service (USPIS) , 
the Federal Bureau of Investigation (FBI), the United States Attorney's 
Office for the Northern District of Alabama, and the Department of Justice 
(DOJ) Child Exploitation and Obscenity Section (CEOS) . 

Project Flicker has identified a criminal organization that is operating in 
excess of 150 different member restricted child exploitation websites. The 
criminal organization e mployed various PayPal accounts to process th e monthly 
subscription payments . | (b)(7)(E) | 


(b)(6), (b)(7)(C>, (b)(7)(E) 


In August 2007, Special Agent T (b)(G> (b)(7)(C) | of the F BI Innocent Images Unit 

was contacted by Warrant Officer (WO) I (b)(6) (b)(7)(C) | of the Ministry of 

Internal Affairs of Ukraine. WO I (bxs) (b>(7)(c> | had been contacted by Senior 
Detect ive | (b>(6> (b)(7)(C) | of the Ministry of Internal Affairs of Belarus. SD 

| wc;mpw/) [ explained that his office initiated an investigation into a criminal 
organization operating mu ltiple co mmerci al chil d exploitation websites. The 
discussion between the SA I (b)(6),(b)(7)(c> | and SD | W 7A 1, ” /7 1 indicated that the Belarusian 
investigation was targeting the same organization identified in Project 
Flicker. SA | w '°jV j;r77 l requested specific assistance from the FBI and ICE. On 
October 22, 2007, a meeting was held at the U.S. Embassy in Kyiv, Ukraine. 

The topic of the meeting was the U.S. investigation titled Pro ject Fl icker 
and the Belarusian investigation titled Operation Tornado. SD [^^^3 provided 
the following relevant information on the targets of the Belarusian 
investigation: 
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Individuals responsible for the financial control; 
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The U.S. investigation will continue reviewing evidence and attempt to 
develop any additional leads. Enforcement action is pending in Belarus and 
the Ukraine, where it is anticipated that the individuals identified in the 
financial role of the organization will be arrested. Both the Belarusian and 


Ukrainian law enforcement officials are w orking to further identify the 
individuals identified as | ^G)(b}./ ; :> ]. 


Investigation continues. 
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CASE STATUS: 
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REPORT DATE 

DATE ASSIGNED 

PROGRAM CODE 

REPORT NO. 

121907 

051706 


020 

RELATED CASE NUMBERS: | (b)(7)(E) 


COLLATERAL REQ: 


TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 


TOPIC: [ 


(b)(3): lii U.S.C. 5 3b(jM(d) Child victims and child witnes 


SYNOPSIS: 

In April 2006, Immigration and Customs Enforcement (ICE), Cyber Crimes Center 
(C3) , Child Exploitation Section (CES), initiated an investigation into an 
international criminal organization operating numerous commercial child 
exploitation websites. The investigation has been titled Project Flicker. 

The investigation is currently being worked by ICE/C3/CES, ICE/Resident 
Agent -in- Charge (RAC) Birmingham, the U.S. Postal Inspection Service (USPIS) , 
the Federal Bureau of Investigation (FBI), the United States Attorney's Office 
for the Northern District of Alabama, and the Department of Justice (DOJ) 

Child Exploitation and Obscenity Section (CEOS) . 


This report will document and undercover purchase through a merchant known to 
process payments for various commercial child exploitation websites. 


DISTRIBUTION: 

SIGNATURE: 

| (b)(7)(E) | 

| (b)(6), (b)(7)(C) | SENIOR SPEC AGENT 



APPROVED : 

| (b)(6).(b)(7>(c> | ICE SECTION CHIEF 

ORIGIN OFFICE: KS 
HQ CHIEF, CYBER CRIM 

TELEPHONE: 703 2 9l w 7A Dn,, l 

TYPIST: 
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DETAILS OF INVESTIGATION 


In April 2006, Immigration and Customs Enforcement (ICE) , Cyber Crimes Center 
(C3), Child Exploitation Section (CES), initiated an investigation, into an 
international criminal organization operating numerous commercial child 
exploitation websites. The investigation has been titled Project Flicker. 

The investigation is currently being worked by ICE/C3/CES, ICE/Resident 
Agent- in -Charge (RAC) Birmingham, the U.S. Postal Inspection Service (USPIS) , 
the Federal Bureau of Investigation (FBI), the United States Attorney's Office 
for the Northern District of Alabama, and the Department of Justice (DOJ) 

Child Exploitation and Obscenity Section (CEOS) . 

Project Flicker has identified a criminal organization that is operating in 
excess of 150 different member restricted child exploitation websites. The 
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TECS 

ACCESS 

CODE^p 

PAGE 
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CASE 

NUMBER 

(b)(7)(E) | 


CASE STATUS: INTERIM RPT 


REPORT DATE 

DATE ASSIGNED 

PROGRAM CODE I 

REPORT NO . 

010408 

051706 

LSJ 

021 


RELATED CASE NUMBERS: 


COLLATERAL REQ : 


TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 


TOPIC : 

IliijHHiHH 




1 


In April 2006, Immigration and Customs Enforcement (ICE) , Cyber Crimes Center 
(C3) , Child Exploitation Section (CES) , initiated an investigation into an 
international criminal organization operating numerous commercial child 
exploitation websites. The investigation has been titled Project Flicker. 

The investigation is currently being worked by ICE/C3/CES, ICE/Resident 
Agent -in- Charge {RAC) Birmingham, the U.S. Postal Inspection Service (USPIS) , 
the Federal Bureau of Investigation (FBI), the United States Attorney's Office 
for the Northern District of Alabama, and the Department of Justice (DOJ) 

Child Exploitation and Obscenity Section (CEOS) . 


(b)(7)(E) 


DISTRIBUTION: 

SIGNATURE: 

| (b)(7)(E) | 

| 1 SENIOR SPEC AGENT 



APPROVED: 

| (b)(6), (b)(7)(C) | OI PROGRAM MANAGER' 

ORIGIN OFFICE: KS 
HQ CHIEF, CYBER CRIM 

TELEPHONE: 703 2 9|W^"| 

typist : 
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DETAILS OF INVESTIGATION 


In April 2006, Immigration and Customs Enforcement (ICE), Cyber Crimes Center 
(C3), Child Exploitation Section (CES) , initiated an investigation into an 
international criminal organization operating numerous commercial child 
exploitation websites. The investigation has been titled Project Flicker. 

The investigation is currently being worked by ICE/C3/CES, ICE/Reraident 
Agent- in- Charge (RAC) Birmingham, the U.S. Postal Inspection Service (USPIS) , 
the Federal Bureau of Investigation (FBI), the United States Attorney's Office 
for the Northern District of Alabama, and the Department of Justice (DOJ) 

Child Exploitation and Obscenity Section (CEOS) . 

Project Flicker has identified a criminal organization that is operating in 
excess of 150 different member restricted child exploitation websites. The 
criminal organization e mployed various PayPal accounts to process the roonthr 
subscription payments . | (b)(7)(E) 


(b)(7)(E) 


17, 2007, an ICE agent received a spam e-mail from 
The following text was excerpted from the e-mail: 

Hello member! 
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(b)(3): 18 U.S.C. § 3509(d) Child victims' and child witnesses' rights, (b)(3): 18 U.S.C. § 3509(d) (Federal Victims' Protection and Rights Act), (b)(7)(E) 


AMUSING KIDS: 


On or about December 20, 2007^ the ICE agent access ed the advertisinct website 

known aq I lyubL ^ Jbuy ' d > I URT ' 1 ^ 1 * 15 S * * WdY SctiSWcfSlr wa „ 

Known as I fthilfl v j B j,nfi n n(1 rllllll Wlln I aC URij Iwitnesses rights (b»3V 18 use S 3509fdWFeder|. lne tOl lOWing text WaS 

excerpted from the web page : 


5 35U9(fl) I 


WELCOMETO EE 

YOU HAVE PROBABLY SEEN A LOT OF LOLITA SITES CLAIMING TO BE THE BEST AND MOST 
COMPLETE . 

HOWEVER, THEY ALL HAVE ALMOST THE SAME SERIES OF PICS. 

IF YOU ARE LOOKING FOR SOMETHING REALLY NEW AMUSING KIDS IS THE BEST PLACE TO 
CHECK OUT 


fes of 


images 


depicted 


I 1 (b)(3) 1 8 U.S.C "j) 3bU9( ' d) Child victims 1 

ana ■ 


The web page contained the following hyperlinks: Members; Join 
now; ana Support . The ICE aqent clicked the Join now hyperlink, which 
redirected to riRT I lousu Jbuld) uh.id ^ and chid r, g hts ,bi i Th followina was 

redirected co ukl | m mis r. s ssnami iFptiprni vu-nmv Prmpmnn nmi Rmiir, Am I- ine ronowing text was 


excerpted from the web page at the listed URL: 
GET INSTANT ACCESS 


After the registration you'll get totally over 5,500 exclusive hand- selected 
photos of a very high quality never published before and 2.5GB of exclusive 
Lolita videos. You won't see these pictures and videos anywhere else unless 
they were stolen from our site! In the unlikely case that you are not 
completely satisfied with the content or service we provide, just drop us a 
line and WE WILL GIVE YOU A FULL REFUND RIGHT AWAY! We're not here for the 
quick buck. Our hard-earned reputation means more to us. 

We are offering: 

1. More than 5,500 of absolutely NEW Exclusive never-seen-before Lolita 
pictures . 
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2. 2.5GB of exclusive Lolita videos. 

3. Only high quality and hi-resolution pictures carefully selected specially 
for your pleasure. 

4. 100% confidentiality of your personal data. 

5. 24 hour support of the site. 

Over 5,000 members have chosen to join and stay with I • We can 
boast the industry's lowest unsubscribe rate which is hanging at ^bout 1 per 
cent. Each day, we receive dozens of emails from our grateful members 
thanking for the experience they have with this site. 


Pay by Credit Card 
Main Payment System: 
Join Now 


On the same date, the ICE clicked the Join Now hyperlink, which redirected to 
URL 

| (b)(7)(E) ~| - 

The web page at the listed URL was entitled D . A . Technologies :: Purchase page. 
The web page was a payment form to be completed by the customer, which 
included email; name; country; address; phone; and credit card information. 
The web page also displayed the following e-mail address for support: 
support@flashbill.com. The ICE agent completed the required information and 

clicked the Secure Purchase button which redirected to 

I _ _ (b)(7)(E) _ I . The web 

page displayed a message indicating that transaction was being processed. 
After a few seconds, the ICE agent was redirected to 

| (b)(7)(E) | . 

The web page indicated the transaction was successful. The following 
information was extracted from the webpage: 

YOUR CARD HAS BEEN SUCCESSFULLY AUTHORIZED 


ORDER INFORMATION: 

Amount to be charged: 79 .99 
Order ID: I (b)(6), (b)(7)(C), (b)(7)(E) | 

Name : I (b>(s>,(b>(7>(c> | 

Address : I (b)(G>.(b>(7>(c> | 

Phone: 703211 

Email : I (b)(6), (b)(7)(C) 1 

IP Address: I <b >t B> t b> t7 > t c> | 


ATTENTION! ! ! 

To protect your privacy and avoid you from being associated with the purchased 
site. Your card will be billed for some computer software. 
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Soon You'll receive a formal email receipt from the software company with the 
details of this payment. 

Don't ask them about the membership! They think you've really bought their 
software ! 

If you are contacted by the billing support or by the staff of that software 
company, you must confirm that you purchased their software product and are 
satisfied with it. 


Your Membership Information: 


LOGIN and PASSWORD has been sent to your email. 


For support and billinq inquiries regarding this order please visit: 

I (b)(3): 1 8 U.SC r S 3509(d) CMd" lc t,ms and child wtnesses^ | 33 * 

Iriahta.fhO; 1 8 .U.S.C. S asilSfdl, [Federal Victims' Pralfifflan.anl 

or send an email to: 


c 


On the same date, the ICE agent received an e-mail message from 

I (b)( 3 ): is us c. § 3509(d) child victims and chiiFI . The subject of the e-mail was Login/ Password for Site 
ID ti™rw P /l . The following text was excerpted from the e-mail message: 

We've successfully received your order. 

The order information and membership credentials are as follows: 

Amount : 7 9.99 

Order ID: | ib>[B> (b)(7)(c) (b)(7)(E) 1 

Paysite ID: 1532 

Membership Plan: 30 days membership 


Your Username : 

Your Password: 

Members Area URL: [has been shown on the payment page] 

NOTE: your membership will be activated within a hour. If your password is 
not yet working, please try it again next hour. 

* * * IMPORTANT ! READ THIS CAREFULLY:*** 

To protect your privacy, your card will be formally billed as a payment for a 
product or service at some lawful online store . 

The administration of that store doesn't know anything about memberships we 
sold. They really sure that you purchased their product. 
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You may receive from D.A. Pay a transaction receipt with the details of your 
payment. A payment purpose and how will it appear on your billing statement 
will also be provided in that email. 


Don't be confused by that receipt! 

Remember, formally You've just ordered product described in the receipt! 

If you are contacted by a billing company or by the mentioned above online 
store, please confirm that you bought their product. 


To review your Order details, Members Area and Password or to Ca ncel 


Subscription please refer to this website: [ 


(b)(3). lyU.y.U tjlibuy(d) Child VI 


i urntm inii.sr. 


Questions regarding the MEMBERS AREA access should only be sent to the owner 

I IUKJ) IAUSL. 5 JJUB(UJLMMU toMU HfU) UMIIU I 


of the paysite at the following email: ^ 

BILLING questions and COMPLAINTS please point to: 




Slyt 


* * *WARNING ! DO NOT SEND QUESTIONS ABOUT THIS ORDER TO ANY OTHER EMAILS!*** 


Have a nice time! 


On or about the same date, the ICE aqent accessed the member restricted 
1 at URL] l8U!iU ' fe asuywjjiMia w? 5 — 

The main web 


& 


contain ed a gallery of approximately 37 images of 

p ■ The images were screen shots from the video files 


available for download. Approximately 30 of the video files were downloaded. 

iV ,“| — ( p;i J) rau ' S ' i yssumajin i m v i ct i ms ana e m i a ^mnK5g^rrgnBjB)ij) ' i su.b.L s ' jsusub) | 


The video files display the 

| (b)(3): 18 U S C 5 3509(d) Child victims and ct 




On December 22, 2007, th e ICE agent received an e-mail message from 

I ■ The subject of the message was Bil ling Statement 
. ^1 ^ ^ ... it should be noted that the number I (b)(7)(E) 1 

was the Order ID for the described transaction. The following text was 
excerpted from the e-mail message: 

Dear Madam or Sir, 

This statement reflects details of the order ti l (b)(6) (b)(7)(C) (b)(7)(E) | placed by you on 
2007-12-21 


Order Date: 2007-12-21 

Charge Date: 2007-12-22 

Charge Type: ONE-TIME (no rebi lls) 

Card Number: | (b)(6)(b)(7)(C)(b)(7)(e) | 
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Formally Payment For: Network Access (noted in your ban k records) 
Actually Payment For: 30 days membership at I '^^1, I 

Amount : U SD 19.99 

Order ID; | (b>(6>,(b>(7>(c>,(b>(7>(E> 1 

Subscription ID: 


This charge will appear on your card statement as ' 1 I " . 


Access to purchased products and serv ices along with order details are 
available from the following website: 1,1“” ^"n Tr ™ £'£71 


* * * IMPORTANT NOTE:*** 

WE DO NOT ACCEPT CHARGEBACKS! 

Your IP address along with you computer's ID as an evidence are applied to the 
order record. All orders charged back due to fraudulent activities will be 
diligently pursued through your local jurisdiction and federal authorities for 
prosecution to the fullest extent of the law. Non -recongni zing a" charge in 
your statement is not the exception! 


Our DISPUTE/ CHARGEBACK policy is available at 

, WrJ;: , iu , w.JX.i3 ,, JJU9i0 , /Liniiirviaiii l is , Brue.niiu|wi(riWsw - rig!iW(UAB;. 1 iu - i 


If you have questions about this order, please sent it only to the following 
email : 

| — (B)(3) 1 1 8 u b i s jsuma) m il l v i c ti ms a na em i a — | 

IviiitnuFi'iHi rinhta-thltaii&ll S H R afinnirll (Farlarnl Virll 

WARNING! FOR SECURITY REASON, DO NOT REPLY OR WRITE ABOUT THIS ORDER TO ANY 
OTHER EMAILS! 


Best Reqards, 
i mw l au.b.u r 
I R annsfrl^ nhilii I 


|(b>(3>:18U.S.(:.S3bUWd>| 

|child victims and child wi | LiMji 


(b)(3): 1 8 U.S.C. § 3509(d) Child victims' and child witnesses' rights, (b)(3):18 U S C. § 3509(d) (Federal Victims’ Protection and Rights Act), (b)(7)(E) 
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E-mail correspondence providing the user name and password information, as 
well as the transaction receipt were received from the same e-mail addresses 
identified above: | — w u s l § jsuyiaj uiiib vicnrns snn sine i wimessu ngmuBjiJ): is usl § J3U9(B) (hsaersi uirams — | The 

e-mail providing the user name and password contained identical language as 
noted above; as did the transaction receipt e-mail. Each of the three 
transactions was identical in process and form. 


(b)(3): 1 8 U.S.C. § 3509(d) Child victims' and child witnesses' rights, (b)(3): 18 US C § 3509(d) (Federal Victims' Protection and Rights Act), (b)(7)(E) 


The main web page for the member restricted website known as 
contained approximately 46 image files depicting L * 


» iRiisr, fi asnaMUFeri 


Approximately 35 of the imaqe files represented hyperlinks to full qalleries 

Of the I (b)(3): IB l/Bt !j 3buy(d) Child victims and ch'ild witnesses rights (b)(3) 1!! | ^{, ov nn .J mar , 0 F-lloa 


I 1 ) S r: S 3Rll.gii1i jFeiler.-il Victims' Pn-irerlinn anl Rights 

sented hyperlinks to video fil 


-* e r 

Within each image gallery, the L 


H. The other 11 imaqe files 
— jH . I (B)[ JJ' 1 8 u s l 5 J3U9(n) cniTBVTfeimg sun wiio witnesses I 

k i : i, i , i |i i : 1 ' i!| )t ii . i i t i | ii ,v(.' i ' | i' . 


(b)(3): 1 8 U.S.C. § 3509(d) Child victims’ ar 


Id witnesses' rights, (b)(3): 18 U.S.C. § 3509(d) (Federal Victims' Protection and Rights Act) 


The main web page for the member restricted website known as 
contained approximately 95 image files, which represented hyper links to 95 


(b)(3): 18 U.b.U. Ij 3bUy 


individual qalleri es containing in excess of 28,000 files. Some of the 

qalleries depicted | .;,v ;.7": I. although many of the galleries 

- e 1 fJ- mgae 


appeared to be sel 


ANALYSIS 


As noted above each of the transactions following identical patterns including 
identical e-mail addresses and content. Each transaction wag conducted 
through an advertising website located within the following domain: 

Ir^ r a hiiri H v^imj ; S5) • Using a publicly available database on the Internet the 
following information was obtained: 

Registrant Name: I (b)(G) (b)(7)(C) | 

Registrant Address: I (b)(G) . (b . ) . ( , 7 . ) . ( . c !... 1 - Smithville > 0H 44677 

Registrant Phone Number ; +1.1330341 '7™ ' rT I 
Registrant Email: I (b)(6), (b)(7)(c) | 

IP Address : | (b)(6), (b)(7)(C) | 

OrgName: AltaVista Company 

Address: 701 First Ave, Sunnyvale CA 94089 
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It should be noted that the above listed individual probably had his identity 
stolen and probably has nothing to do with the actual registration of the 
domain name riwumaer.us. 


Each transaction accessed a payment website at the following domain: 
secure.billing-company.net. Using a publicly available database on the 
Internet the following information was obtained: 


Registrant ; 


Dalian , TX 7 5287 
-<-97224 

| (b)(6), (b)(7)(C) ®aol . com 

IP Address : | (b)(e>,(b>(7>( 

Netname: ELTEL 
Descr: SPB Network 
Person: 

Address 

Phone: +7.812 


(b)(6), (b)(7)(C) 

TIGS T~ 


Saint-Petersburg Russia 


It should be noted that the listed registrant probably had his identity stolen 
and has nothinq to do with the actual registration of the domain name 

1(b)(3): 18 U.3.C. § 3509(d) Child victims andl 
I child witnesses iiflhti.(h)(2IllLII&iLL3ir 


(b)(3): 1 8 U.S.C. § 3509(d) Child victims' and child witnesses' rights, (b)(3): 1 8 U.S.C. § 3509(d) (Federal Victims' Protection and Rights Act), (b)(6), (b)(7)(C), (b)(7)(E) 
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Registrant Phone Number: +31 . 77371_|^££J 


Registrant Email; | (b)(6>,(b>(7>(c> | 

IP Address: I mb), ( b)(7)(c) 1 

Netnam e: MCHOST 

DeSCr; | (b)(6)~(b)(7)(C) | 

Address : Closed Stock Company 11 Information Center" 

Address: I {tmmmc) I , 101934 Moscow Russia : 

Phone: +7.095 . 77 1 I “ 

As noted above, each of the e-mails contained identical language and provided 
an administrative contact point of I 1 '? £'n 0 1 and 

support@bill-support.com. Using a publicly available database the following 
information was obtained about domain name bill-support.com-. 


Registrant: 

IP Address: 

OrgName : McColo Corporation 
Address: 64 East Main Street, Box 275, Newark DE 19715 


(b)(6), (b)(7)(C) 


As noted above, each of the member restricted websites was hosted at a 
sub-directory within domain name happy-members.com. Using a publicly 
available database the following information was obtained about domain name 
happy -members . com: 


IP Address: I (b>(6> (b>(7)(c> 

Netnam e: NetDirect-Net 

Descr : i imrzz 

Person _ 

Address" 

Phone 


Kleyer S trasse 79/Tor 14, 60326 Frankfurt DE 
+49.69 . 905 1 I 


(b)(6), (b)(7)(C), (b)(7)(E) 


IP Address: I ( ^^^ b>( P, (C> , 

Canonical name : 

Registrant: I I 

OrgName: Soft layer Technologies, Inc. 

Address: 1950 N. Stemmons Freeway, Dallas TX 75207 

IP Address .- | (b)(6), (b)(7)(c) [ 
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Canonica l^ name : 

Registrar! ~ 

Address: (b)(6Mb)(7)(C) Humble TX 77338 

Phone: 713481 t ° ) ^, ) A 0) I ' 

Email: | (b)(6), (b)(7)(c) | 

OrgName: HostDime.com, Inc. 

Address: 189 South Orange Avenue, Suite 150 OS, Orlando, FL 32801 
IP Address : I - 

~ . , (b)(6), (b)(7)(C) 

Canonical na| 

OrgName: Softlayer Technologies, Inc. 

Address: 1950 N. Stemmons Freeway, Dallas TX 75207 


(b)(6), (b)(7)(C), (b)(7)(E) 


Registrant Smart VPN Ser vices LTD 
IP Address : | ib)|G),(b)(7)(C) | 

OrgName: Layered Technologies, Inc. 

Address: 5085 W. Park Blvd, Suite 700, Plano TX 75093 

The following information was obtained from the website vpnserv-cs.com: 

International Administrative Office 

Smart VPN Services LTD 

5 Percy st Office 4 

London, WIT IDG UK 

+44.20.3002.4672 

www. smart -vpn- service . com 

Using a publicly available database the following information was obtained: 

Registrant S mart VPN Serv ices LTD 
IP Address: | (b>(s> (b)(7)(C) | 

OrgName: Layered Technologies, Inc. * 

Address: 5085 W. Park Blvd, Suite 700, Plano TX 75093 

A review of the website at URL http://smart-vpn-service.com indicated that 
Smart VPN Services appears to sell Virtual Private Networks (VPN) . They offer 
packages from $14.99 to $99.99 per month. A VPN allows a user to protect 
their true identity when surfing the internet by connecting to a server leased 
to Smart VPN Services before connecting to any websites on the Internet. 
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Investigation continues. 
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CASE NUMBER 1 (bXTHE) T 

TITLE : COMMERICAL CP WEBSITE KNOWN AS 
CASE” STATUS! INTERIM 1PT 


REPORT DATE 

DATE ASSIGNED 

PROGRAM CODE 

REPORT NO. 

011408 

051706 

t 

022 

■ 


RELATED CASE NUMBERS': | mam 


COLLATERAL REQ: 

~ TYPE “OFREPORTl 
INVESTIGATIVE FINDINGS 


TOPIC: REQUEST FOR NCMEC/CRIS ANALYSIS ON MEMBER WEBSITE 


SYNOPSIS : 

In April 2006, Immigration and Customs Enforcement (ICE) , Cyber Crimes Center 
(C3) , Child Exploitation Section (CES) , initiated an investigation into an 
international criminal organization operating numerous commercial child 
exploitation websites. The investigation has been titled Project Flicker. 

The investigation is currently being worked by ICE/C3/CES, ICE/Resident 
Agent -in-Charge (RAC) Birmingham, the U.S. Postal Inspection Service (USPIS) , 
the Federal Bureau of Investigation (FBI), the United States Attorney's Office 
for the Northern District of Alabama, and the Department of Justice (DOJ) 

Child Exploitation and Obscenity Section (CEOS) . 

This report serves as a request to the National Center for Missing and 
Exploited Children (NCMEC) to have images captured from a commercial child 
pornography website reviewed against the Child Recognition Identification 
System (CRIS) . 


DISTRIBUTION : 

SIGNATURE: 

| (b)(7)(E) | 

| (b)(6) (b)(7)(C)' " m | SENIOR SPEC AGENT 



APPROVED : 

I (b)(6), (b)(7)(C) I OI PROGRAM MANAGER 

ORIGIN OFFICE : KS 
HQ CHIEF, CYBER CRIM 

TELEPHONE: 703 29| wl °/A Dn/, l 

TYPIST: l lD A°, , A D, l 
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CASE PROGRAM CODES: 
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DETAILS OF INVESTIGATION 


In April 2006, Immigration and Customs Enforcement (ICE), Cyber Crimes Center 
(C3) , Child Exploitation Section (CES) , initiated an investigation into an 
international criminal organization operating numerous commercial ; child 
exploitation websites. The investigation has been titled Project Flicker. 

The investigation is currently being worked by ICE/C3/CES, ICE/Resident 
Agent -in- Charge (RAC) Birmingham, the U.S. Postal Inspection Service (USPIS) , 
the Federal Bureau of Investigation (FBI) , the United States Attorney’s Office 
for the Northern District of Alabama, and the Department of Justice (DOJ) 

Child Exploitation and Obscenity Section (CEOS) . 

On December 14, 2006, SS/A received information from NCMEC reg arding a 

commercial website offering child p ornography for sale via cybertip I (b>(7>( - E > I- 
The title bar stated the following: I- On the same date, SS/A | tP ,7»A°1 


(b)(3): 1 8 U.S.C. § 3509(d) Child victims' and child witnesses' rights, (b)(3): 18 U.S.C § 3509(d) (Federal Victims' Protection and Rights Act), (b)(6), (b)(7)(C), (b)(7)(E) 


C3/CES requests that the provided image files be run against the NCMEC Child 
Recognition Identification System (CRIS) . Any new infor mation developed 
related to the victims should be forwarded to SS/A 

Senior Special Agent | (b)(6), (b)(7)(C) 1 

ICE/ C3 /CES 

11320 Random Hills Road, Suite 
Fairfax, VA 22030 
(703) 2 

| (b)(6), (b)(7)(C) ~| 


Investigation continues. 
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TITLE: COMMERICAL CP WEBSITE’ KNOWN AS^ 


TECS ACCESS CODE 


PAGE 1 



CASE NUMBER | 

(b)(7)(E) 

nr 


CASE STATUS: 


INTERIM RPT 


REPORT DATE 

DATE ASSIGNED 

PROGRAM CODE 

REPORT NO. 

040208 

051706 

ra 

023 


RELATED CASE NUMBERS: 


COLLATERAL REQ: 


TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 


In April 2006, Immigration and Customs Enforcement (ICE), Cyber Crimes Center 
(C3) , Child Exploitation Section (CES) , initiated an investigation into an 
international criminal organization operating numerous commercial child 
exploitation websites. The investigation has been titled Project Flicker. 

The investigation is currently being worked by ICE/C3/CES, ICE/Resident 
Agent -in -Charge (RAC) Birmingham, the U.S. Postal Inspection Service (USPIS) , 
the Federal Bureau of Investigation (FBI), the United States Attorney's Office 
for the Northern District of Alabama, and the Department of Justice (DOJ) 

Child Exploitation and Obscenity Section (CEOS) . 


(b)(7)(E) 


DISTRIBUTION: 


[ (b)(7)(E) | 

| | SENIOR SPEC AGENT 



APPROVED : 

| (b)(6), (b)(7)(C) | OI PROGRAM MANAGER 

ORIGIN OFFICE: KS 
HQ CHIEF, CYBER CRIM 

TELEPHONE: 703 2S\^W lK "\ 

TYPIST: _ 
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In April 2006, Immigration and Customs Enforcement (ICE), Cyber Crimes Center 
(C3) , Child Exploitation Section (CES) , initiated an investigation into an 
international criminal organization operating numerous commercial child 
exploitation websites. The investigation has been titled project Flicker. 

The investigation is currently being worked by ICE/C3/CES , ICE/Resident 
Agent -in- Charge (RAC) Birmingham, the U.S. Postal Inspection Service (USPIS) , 
the Federal Bureau of Investigation (FBI), the United States Attorney's Office 
for the Northern District of Alabama, and the Department of Justice (DOJ) 

Child Exploitation and Obscenity Section (CEOS) . 


Project Flicker has identified a criminal organization that is operating in 
excess of 150 different member restricted child exploitation websites. The 


criminal organization e mployed various PayPal accounts to process the monthl 
subscription payments, f 


(b)(7)(E) 


On March 25, 2008, an ICE agent assigned to the Cyber Crimes Center (C3) , 

Child Exploitation Section (CES) accessed a child exploitation website located 
at URL: I I . The website contained hyperlinks to the 
following commercial child exploitation advertising websites: 
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REPORT NUMBER: 023 


(b)(3): 18 U.S.C. § 3509(d) Child victims' and child witnesses' rights, (b) 
(3): 1 8 U.S.C. § 3509(d) (Federal Victims' Protection and Rights Act) 


On the same date , the ICE agent clicke d the hyperlink for the advertising 
website known as LS 'll! 'T™ m £™J; which redirected to 
I (b)(3): I d u b l . i, Jbu»(d) LhHd wchmm 1 V 0 S | The website at the ii ste d URL 


nl VirlimV Prnlpriim nr 


contained several web 

(| (b)(3): 18 U.S.U. & 3bUy(d) Uhi 
— TOTT - 


X 


ARCHVIE page {[ 


i jsuy(a) unna victims ana wHaWmssses rigiws : (B)(3). la u s l § jsuy(a) (heaerai vi 

(B)U ) 1 is u.b t. 4 jsuyiai iriis rffiS wiwisiii pigiwi (B)UJ' iu u 1 1 4 . 


PHOTO ARCHIVE 
1 ) ; and a VIDEO 


The following text was excerpted from the ABOUT page : 

Hello, I am I . I'm a 12 y,°. As every normal girl of my age; I go to 

school. My best friend is | Wk °/A UA/, 1 and together we go to art school. I love 
dancing and I'm not afraid to eat sweets at all because I lead a very active 
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way of life and don't do any harm to my figure. . 

.And I don't feel 


uncomfortable before camera, because I've been through it many many times and 
and I can say I am a real model now! 

My name is I I and I'm 13 years old. I study in the school of arts in Kiev 
for already 7 years. Along with my friend I , I've already achieved 

serious results, which you can see yourself! Now, that I've got a chance to 
realize my fantasies and secret desires, I am as happy as could ever be! 

The PHOTO ARCHIVE page contained two sample images from each of the eight 
galleries. Each gallery contained a brief description. The following text 
was excerpted from the PHOTO ARCHIVE page describing the third gallery: 

And in this set was really easy. Finally, my most secret fantasies were 
displayed to my admirers! Perhaps, it's banal, but I think nothing can turn 
on a girl like me than having fun with a strong jet of host water! 

The two images next to the above text depicted 

(b)(3): 18 U.S.C. § 3509(d) Child victims' and child witnesses' rights, (b)(3): 18 U.S.C. § 3509(d) (Federal Victims' Protection and Rights Act) 


The VIDEO ARCHIVE page contained one sample images from each of the sixteen 
listed video files (it appeared that there were actually eight video files, 
but each video file had been split into two separate sections) . The sample 

,'maap- dpnirt . f , d I |b.M) l o U b l Jb l Md) lhi l d5.ct.ms and child nghts tbfi) I o U b l §, iblMd) federa l Vicbms ' I 

images depicted | pmtartinn iwi Rinhts am I- 

The I I website also contained a SUBSCRIBE we bp ag e 

(| (b)(3): 18 U.S.C. § 3509(d) Child victims' and child witnesses' rights, (b)(3): 18 U.S.C. § 3509(d) (Federal Victims’ Protection and Rights Act)~| . The SUBSCRIBE 

page contained five sample images and three sample video clips. In addition, 
the SUBSCRIBE page contained a hyperlink to entitle MAIN PAYMENT SYSTEM! Click 
HERE to subscribe. On the same date, the ICE agent clicked the above listed 
hyperlink which redirected to 

| (b)(3): 18 U.S.C. § 3509(d) Child victims' and child witnesses' rights, (b)(3): 1 8 U.S.C. § 3509(d) (Federal Victims' Pr otection and Rights Act) | , The 

page at the listed URL was entitled : Purchase Page . The 

page was a form that had to be completed by the individual accessing the page; 
the form requested payment information to include name, address, e-mail, 
telephone, and credi t card information. In addition, the page indicated the 
purchase was for ID: EStSSQ at $99.95. The page also contained the following 
e-mail address; I SSSZSsSI] . After completing the form, the ICE 
agent clicked the SECURE PURCHASE button which redirected to 

| (b)(3): 1 8 U.S.C. § 3509(d) Child victims' and child witnesses' rights, (b)(3): 18 U.S.C. § 3509(d) (Federal Victims' Protection and Rights Act) | . 

The following text was excerpted from the webpage: 

YOUR CARD HAS BEEN SUCCESSFULLY AUTHORIZED 
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ORDER INFORMATION: 

Amount to be charged : 99 . 95 
Order ID: | (b)(6), (b)(7)(C), (b)(7)(E) 1 

ATTENTION! ! ! 

To protect your privacy and avoid you from being associated with the purchased 
site, Your card will be billed for some computer software. 

Soon You'll receive a formal email receipt from the software company with the 
details of this payment. 

Don't ask them about the membership! They think you've really bought their 
software ! 

If you are contacted by the billing support or by the staff of that software 
company, you must confirm that you purchased their software product and are 
satisfied with it. 


Your Membership Information: 


MEMBERZONE| (b)(3): 1 8 U.S.C. § 3509(d) Child victims' 
USERNAME: 

PASSWORD : 


witnesses' rights, (b)(3): 18 U.S.C. § 3509(d) (Federal 
Victims' Protection and Rights Act), (b)(6), (b)(7)(C), (b) 
(7>(E> 


If you cannot access memberzone, please write to 


I — (b)(3) 18 u y.u ij Jbuyjd) uisiia wciuM 1 Anti thiia i 
ImlnRssfis rinhts Ihlffl 18 i) R f. S (ffiDDdl) (Fp.ilp.rnl Vil 


For support and billing inquires regarding this order please visit: 

I P50!)(d) ChJcl victims ' and cWw ' itnes ' s e s '-| 

Innhln ilili.Tl In (J.S r.,.,5 aaiatdl (ff.tlp.tfll Miflima' Ptntflrtinn.fll 


or send an email to: 


□ 

On the same date, the ICE agent accessed the member restricted website at the 
above listed URL. The website contained approximately 2,200 image files and 
16 video files. The image and video files depicted the two female minors that 
were displayed on the LS Maqazine Issue #5 advertising website. In addition, 
*-v,^ ’mag°- ►»«»■ — I TOTS rsSbmr^TW sms mnmrmmsss rmm | 

in* 


(b)(3): 1 8 U.S.C. § 3509(d) Child victims' and child witnesses' rights, (b)(3): 18 U.S.C. § 3509(d) (Federal Victims' Protection and Rights Act), (b)(7)(E) 
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Using a publicly available database, the ICE agent was able to determine the 
following information-. 


| (b)(6), (b)(7)(C) | 

IP Address | (b)(6), (b)(7)(C) || 

OrgName : Network Operations Center Inc . 

Address; PO Box 591, Scranton, PA 18501-0591 
Registrant Contact : WhoisGuard 

| IWIJJ. IB U.S.L. 9 3JUSIUJ UIIIU | 

Registrant ] (b)(6>.(b>(7)(c> |, Brooklyn, NY 11226 

Phone: +718281 kU A7A u ' I ~ 

Email: | (b>(6>,(b>(7>(c> | 

IP Address: I (b)(6), (b>(7)(c> 

Owner: EM Technologies 

Address: Plaza Victoria, Obarrio, 1, 1, Panama 


G 


a 


Registrant: Privacy Protec t . org 
IP Address : I (b>(6>, (b)(7)(C) | 

OrgName: 

Address: Access IT Hosting Services, 
10004 


75 Broad Street, Suite 1902, New York, NY 


| — (b)( ' 3 ' ) , T a"0 ' ST: ~ p '5i 3g raT TJhiid — | 

Registrant: VELDEX 

IP Address: I (b>(6> (b)(7)(c) | 

OrgName: McColo Corporation 

Address: 64 East Main Street, Box 275, Newark, DE 
Investigation continues. 
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SYNOPSIS: 

In April 2006, Immigration and Customs Enforcement (ICE) , Cyber Crimes Center 
(C3) , Child Exploitation Section (CES) , initiated an investigation into an 
international criminal organization operating numerous commercial child 
exploitation websites. The investigation has been titled Project Flicker. 

The investigation is currently being worked by ICE/C3/CES, ICE/Resident 
Agent- in-Charge (RAC) Birmingham, the U.S. Postal Inspection Service (USPIS) , 
the Federal Bureau of Investigation (FBI), the United States Attorney's 
Office for the Northern District of Alabama, and the Department of Justice 
(DOJ) Child Exploitation and Obscenity Section (CEOS) . 


This report will document investigative information received from the Dutch 
National Police and Europol . 


DISTRIBUTION: 
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DETAILS OF INVESTIGATION 


In April 2006, Immigration and Customs Enforcement (ICE) , Cyber Crimes Center 
(C3), Child Exploitation Section (CES) , initiated an investigation into an 
international criminal organization operating numerous commercial child 
exploitation websites. The investigation has been titled Project Flicker. 

The investigation is currently being worked by ICE/ C3/ CES, ICE/ Resident 
Agent- in- Charge (RAC) Birmingham, the U.S. Postal Inspection Service (USPIS) , 
the Federal Bureau of Investigation (FBI), the United States Attorney's 
Office for the Northern District of Alabama, and the Department of Justice 
(DOJ) Child Exploitation and Obscenity Section (CEOS) , 

Project Flicker has identified a criminal organization that is operating in 
excess of 150 different member restricted child exploitation websites. The 
criminal organization e mployed various PayPal accounts to process th e monthly 
subscription payments. I (b)(7)(E) | 


(b)(7)(E> 


The investigation has uncovered at least two distinct payment websites 
utilizing by the criminal organization to collect subscriber payment 
information. The first, iWest, was in operation from approximately July 2006 
to September 2007. The second, D. A. Pay or D . A . Technologies, was first seen 
in May 2007 and is still in operation. 

On or about May 15, 2008, ICE/ CES/ C3 received information from the Norwegian 
National Criminal Investigative Service (NCIS) that they were conducting a 
joint investigation with the Dutch National Police (DNP) into a payment 
processor/ company known as D.A. Pay. 

On June 20, 2008, ICE/C3/CES received a document (File Number: I (b)(7)(E) | ) 

from the Europol Liaison Office in the U.S. The document provided some 
initial information on the DNP/NCIS investigation involving D.A. Pay. The 
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investigation is entitled Ope rat ion 1(b)(7)(E) l and falls under the COSPOL/CIRCAMP 
work file TWINS. The document contained a request for information on several 
individuals and/or companies that may have involvement in the commercial 
distribution of child exploitation images. The following text was excerpted 
from the document: 


BEGINNING OF EXCEPRT: 

Operation Robin is an investigation co-ordinated by the Netherlands and 
supported by the COSPOL Internet Related Child Abusive Material Project 
(CIRCAMP) and AWF Twins. It deals with phase 2 of the CIRCAMP project plan 
which is related to investigating the money flow from pay-per-view websites 
offering child abuse material. 

The starting point of this i nquiry is the address I (b)(6) (b)(7)(c> | in IJMUIDEN, the 
Netherlands. A company named registered at 

this addre ss. The dire ctor of this company is a I !b>(s> (b>(?xc> | 

r/4“/A u l born | (b)(6), (b)(7)(C) | . Another 93 businesses are registered wit h this address 
and all are offering electroni c payment services. I (b)(6), (b)(7)(C) | 

I (b)(6), (b)(7)(C) ~1 is the authorised signatory for all these 

businesses. This means that he is entitled to sign fiscal tax returns, 
correspondence and contracts. He is also authorised to register the company 
with the Dutch Chamber of Commerce. 

The Dutch National Police Service has received a number of complaints from 
police services over the world about businesses registered at the mentioned 
address in IJMUIDEN for providing payment services to pay-per-view websites 
offering child abuse material. 

AWF Twins has received the records of the Ch amber of Commerce of all 
companies registered at | (b>(G> (b)f7):c> | All registered directors and 

shareholders are listed as living in 19 different countries, all over the 
world. At the moment the legitimacy of the records is unknown. It .is too coon 
to determine whether all companies are involved in criminal activities, it is 
even not certain whether the names on the list are aware they are mentioned 
as director of a company registered in the Netherlands. Please note therefore 
that no individual is considered a suspect yet. 

Below you will find a list of names registered in your country and the name 
of the company they are believed to be managing director of. All companies 
are registered at the given in the Netherlands and all companies offer 
electronic payment services . 


(b)(6), (b)(7)(C) 
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Registered with the Office of the Secretary of State of Delaware. 


It would be appreciated if you could inform us of the following: 

Would it be possible for you to determine if the given identities are genuine 
and correspond to existing persons? 

Are the individuals registered in your country known to your criminal records? 
Are the individual registered at the given address? 

Is the company name known to your records? 

Thank you in advance for your co-operation. 

END OF EXCERPT: 

There was no information available in TECS/NCIS available for the following 
individuals : 


(b)(6), (b)(7)(C) 


There was no information available in TECS available for any of the above 
listed companies. 

There was border crossing information available for the following individuals: 


(b)(6), (b)(7)(C) 
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The information was matched on the date of birth and full name as provided by 
Europol . 

No criminal records were found for any of the individuals . 


None of the individuals or companies has been identified by Project Flicker 
(Myosis/Tornado) . 

The following individuals had a positive hit in Autotrack: 


(b)(6), (b)(7)(C) 


The positive hit provides that at some point the individual was linked to the 
address provided by Europol. A positive identification cannot be made 
without interviewing all of the individuals independently. 

It is not possible to positively link the individuals provided by Europol to 
the respective companies without additional information and/or legal process. 

From the provided information it does not appear that any of the companies 
provided by Europol conduct any significant amount of business within the 
U.S. and therefore may have no real financial interests in the U.S. 

Investigation continues , 
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COLLATERAL REQ: 


TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 


TOPIC: |_ 


X 


SYNOPSIS: 

In April 2006, Immigration and Customs Enforcement (ICE) , Cyber Crimes Center 
(C3 ) , Child Exploitation Section (CES) , initiated an investigation into an 
international criminal organization operating numerous commercial child 
exploitation websites. The investigation has been titled Project Flicker. 

The investigation is currently being worked by ICE/C3/CES , ICE/Resident 
Agent- in- Charge (RAC) Birmingham, the U.S. Postal Inspection Service (USPIS) , 
the Federal Bureau of Investigation (FBI), the United States Attorney's 
Office for the Northern District of Alabama, and the Department of Justice 
(DOJ) Child Exploitation and Obscenity Section (CEOS) . 


This report will document an undercover purchas 

■ ' ’ § 33UM(d) I 


of the child exploitation 
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DETAILS OF INVESTIGATION 


In April 2006, Immigration and Customs Enforcement (ICE) , Cyber Crimes Center 
(C3), Child Exploitation Section (CES) , initiated an investigation into an 
international criminal organization operating numerous commercial child 
exploitation websites. The investigation has been titled Project Flicker. 

The investigation is currently being worked by ICE/C3/CES, ICE/Resident 
Agent -in -Charge (RAC) Birmingham, the U.S. Postal Inspection Service (USPIS) , 
the Federal Bureau of Investigation (FBI), the United States Attorney's 
Office for the Northern District of Alabama, and the Department of Justice 
(DOJ) Child Exploitation and Obscenity Section (CEOS) . 

Project Flicker has identified a criminal organization that is operating in 
excess of 150 different member restricted child exploitation websites. The 
criminal organization e mployed various PayPal accounts to process th e monthly 
subscription payments. | (b)(7)(E) | 


(b)(7)(E> 


The investigation has uncovered at least two distinct payment websites 
utilizing by the criminal organization to collect subscriber payment 
information. The first, iWest, was in operation from approximately July 2006 
to September 2007. The iWest payment method primarily utilized the 14 PayPal 
account discussed above. The second, D.A. Pay or D.A. Technologies, was 
first seen in May 2007 and is still in operation. This method utilizes 
traditional merchant accounts. The following merchant accounts have been 
identified: GEO LOCATOR, PRIVATE CONNECT, MULTICARDS.COM, and VPNSERV-CA.COM. 


On July 11, 2008, an ICE agent assigned to the Cyber Crimes Center (C3) , 
Child Exploitat ion Section (CES) acces sed a child exploitation we bsite 

1 f P>d URT. - I WW 'e u.&u § unna victims ana ■ The wefosite W3S entitled '1 io u.s 

Iimuuim' Jr.hilf1 wjlnfiflSRfl rinhts tHif.1V Ifi U S fi SSSlMfrir weufJlLC w f „ IflipWlKbilri 

[SteSSBS SSJ The webs it ese rved as a portal to several child 


■ , s asmyl 1 . 

exploitation advertising websites: 
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(b)(3): 18 U.S.C. § 3509(d) Child victims’ 
and child witnesses' rights, (b)(3): 18 
U.S.C, § 3509(d) (Federal Victims' 
Protection and Rights Act) 



excerpted from the webpage displayed at the above listed URL: 


"WELCOMETO - EKZ233” 

"YOU HAVE PROBABLY SEEN A LOT OF LOLITA SITES CLAIMING TO BE THE BEST AND 
MOST COMPLETE." 

"HOWEVER, THEY ALL HAVE ALMOST THE SAME SERIES OF PICS." 

"IF YOU ARE LOOKING FOR SOMETHING REALLY J IS THE BEST PLACE 

TO CHECK OUT . « 


In addition, the webpage contained approximately 41 images depicting 
prepubescent female minors engaged in sexually explicit conduct. The images 
depicted close up shots of the female minors' genitalia. The webpage also 
contained the following hyperlinks: Members; Join Now; and Support. 


On the same date 
redirected to [ 


IBM'lt 


gent clicked the Join No w^h^-per 1 ink , which 


3 The webpage 


contained another JOIN NOW hyperlink, as well as a hyperlink redirected to a 
backup billing system. On the same date, the ICE agent clicked the JOIN NOW 
hvnerlink, which redirected to 

| (BhS): la u.b.u. 4 J5uy(a) unna victims ana enna witnesses rignB.iBHJjiiisusu 5 J3uyia> u-saerai viwims i-rownion 1 

I iinti Rinhts Am I- 1 ne P a 9 e ac me 

listed URL was entitled D.A. Technologies :: Purchase Page (also identified as 
Flash Bill) . The page was a form that had to be completed by the individual 
accessing the page; the form requested payment information to include name, 
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address, e-mail, telephone, and credit card information. In addition, the 
page indicated the purchase was for ID: 1409 at $99.9 5 {30 d|LYsmembership ) . 
The page also contained the following e-mail address: I ^'n 
After completing the form, the ICE agent clicked the SECURE PURCHASE button 
which redirected to 

(biij-V) iniJSi-; r, 3 r ; Q : : i ( , I ); quid i Vir Prote r :n am- ~ A-; | 

I . The following text was excerpted from the webpage: 

"Attention! READ CAREFULLY the information stated below!" 


"YOUR CREDIT CARD IS NOT YET CHARGED!" 

"You've just gone through a verification step!" 

"To Complete Payment, Follow these Simple Instructions:" 


"1. CLICK THIS BUTTON TO GET INTO SECURE PAYMENT PAGE: PAY NOW" 
"2. PAY THERE FOR AN OFFERED PRODUCT" 

"3. After you successfully paid, you will receive an email with 
username /pas sword for your Membership within 5-15 minutes." 


"Remember! If you have questions about this order, send them only to:" 

„i (P)(J): i i u.&.l. 5 .juuiimi i .n i n ■-■i ■ ■ ■ ■ A i„ 
lwitn«i«' rinhH fh)f3V 1 R 1 1 R r R 3503/(1) (Fartarnl Vi I 

"WARNING!!! To Avoid Serious Problems, Do NOT Write to any Other Place!!!" 


"ATTENTION! ! J » 

"To protect your privacy and avoid you from being associated with the 
purchased site, Your card will be billed for some computer software." 

"Soon you may receive a formal email receipt from the software company with 
the details of this payment." 

"Don't ask them about the membership! They think you've really bought their 
software ! " 

"If you are contacted by billing support or by the staff of that software 
company, you must confirm that you purchased their software product and are 
satisfied with it." 


"YOUR ORDER DETAILS:" 

" Amount : 9 9.95 " 

"Order #: I wuxe) I " 

"Paysite ID: 1409" 

On the same date the ICE agent clicked the button identified in Step 1 above, 
which redirected to l ww . The following 

information was excerpted from the webpage : 

OFFICIAL USE ONLY 

THIS DOCUMENT IS LOANED TO YOU FOR OFFICIAL USE ONLY AND REMAINS THE PROPERTY 
OF THE DEPARTMENT OF HOMELAND SECURITY, ICE. ANY FURTHER REQUEST FOR 
DISCLOSURE OF THIS DOCUMENT OR INFORMATION CONTAINED HEREIN SHOULD BE REFERRED 
TO ICE HEADQUARTERS TOGETHER WITH A COPY OF THE DOCUMENT. 


Page 242 of 929 



OFFICIAL USE ONLY 


DEPARTMENT OF HOMELAND SECURITY 

PAGE 6 

ICE 



CASE NUMBER | (b)(7)(E) | 

REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: 025 


"IMPORTANT NOTE, PEASE READ:" 

"You are about to enter a payment page where you have to pay for some legal 
product .. .After you pay, you will receive a transaction receipt from 
MultiCards regarding that product. Warning! DO NOT ask Multicards or the 
supplier of the product about your membership! If They contact you, just 
confirm that you are satisfied with their product and authorize the charge." 

The webpage also contained a button labeled CLICK HERE TO PROCEED. On the 
same date, the ICE agent clicked the above listed button, whic h redirected to 

I g/in; k; i i s ; :.i) ;hii ; .■■■■■■ .■;■■■. s . ■■ ^ ■■■ a | , The webpage 

was entitled SECURE PAYMENT FORM Collecting Details. The webpage was a 
payment form for a company known as MultiCards (an online payment processor) . 

The webpage required the user to enter specific information including 
payment method (type of card), card number, name on card, expiration date, 
and the card security code. The following text was excerpted from the 
webpage: 

"MulitCards is the designated Payment Processor for: s "n I 

brought to you by EBONY ENTERPRISES L.C." 

"MultiCards.com will appear on your cardholder/bank statement" 

"Product description: TraceWiper Software = 99. 9S USD" 

On the same date, the ICE entered the required information and clicked the 
CONTINUE button, which redirected to 

l^(b>(3>j18U^aC^§ 3509(d>Childvictims|ondcbildwitnesses|righteXb>(3>^ _ The Webpage 

as the above listed URL indicated that the payment had been successfully 
processed . 


On the same date, the ICE agent received an email in the undercove r email 

account used during the transaction from 1 1 "* I . The 

subject of the email was Membership to Site ID 1,,^ ri I ■ The following text was 
excerpted from the email: 


"This is you ne w Membership acce ss to the site ID |(b>(7>cE>| ' 
"Your Username: I (b)(3)’""'-'' 1 

"Your Password: |(b)(3): - i 
"Members Area URL: [ 


U.S.C. § 3509(d) Child 


"To load the members are url, please copy-and-paste it from this message into 
your browser's address bar>" 


"Here is your order information: 11 
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"Order ID: I (b>(s>, (b>(7>tc>,cb>(7>(E> I 11 
"Order Date: 2008-07-11" 

"Amount Paid: $99.95" 

"Questions regarding m embers area contacts and access should only be sent to: 
P ^ :Lline| <l uestions and complaints please sent only to: 

Mtnsssss’ rights fbW3V 1 8 U SC 8 3509fdi federal Vicl* 

"WARNING! FOR YOUR SECURITY, DO NOT WRITE ABOUT THIS MEMBERSHIP TO ANY OTHER 
EMAIL ! " 

Additional email mess ages were received from and 


On the same date, the ICE agent accessed the member restricted website at the 
above listed URL. The website contained annroximatelv 35 video files. The 

cj, , I (b)(J)! 18 U.S.C. () Jbuy(d) Uhild victims' bnd cBMwSnesses' r^hts (bJ(S>* 1 8 U.y.U. ^ 3bUy(d) (Hedeffil Vittims 1 I 

1 1 Hm t, i i m i PmrfiB i nn mill R i nhM Ant) 1 

The video files also contained lascivious display of 


Using a publicly available database, the ICE agent was able to determine the 
following information: 


IP Address: I (b)i6)ib)(7)(C) 

OrgName: 

Address: (WjMbHTKC) 

Registrant Contact: | 


Brampton, Ontario, Ca nada 

1 


Recristrant I (b)(6), (b)(7)(C) |, Orlando, FL 32803 

Phone: t 40730|WWI| 

Etna i 1 : | (b)(6) (b)(7)(C) | 

IP Address : I (b)(s> (b)(7)(C) | 

Owner: NETPLACE 

Address: Tevosyana 40a- 89, Electrostal, Moscow Region, Russia 


Registrant : 

(b)(6), (b)(7)(C) |, 

IP Address : 

(b)(6), (b)(7)(C) I 


, Vista, CA 92084 
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Address: Kleyer" Strasse 79/Tor 14, Frankfurt, DE 60326 


Registrant: VELDEX 

IP Address: I (b>(6>,(b>(7>(c> | 

OrgName: McColo Corporation 

Address: 64 East Main Street, Box 275, Newark, DE 


i(B)(y)! ib u.y.u. & asuy(fl) umia i 

Ivirtims pnd child witnesses rich I 

Registrant : [_ 


Beach, FL 3 3482-6416 
IP Address : | (b>(s>,(b>(7>(C) 


3 Delray 


OrgName: eNom, Inc 

Address: 15801 NE 24st Street, 


I (b)(3): VS U.3.C. § 350S(d) Child 


Bellevue, WA 98008 


Registrant : 

1 

(b)(6), (b)(7)(C) 

1, HB 

5627SV, NL 




IP Address : 1 

| (b)(6), (b)(7)(C) || 



CustName: Citrix Systems, 
Address: 751 West Cypress 

Inc 

Creek Road, Fort Lauderdale, 

FL 33309 


Y n " iu . ,1 



IP Address; 

(b)(6), (b)(7)(C) | 



Registrant : 


(b)(6), (b)(7)(C) 

1, Teqelen, 5932, 


Descr: McHost.Ru Inc. 
Address: 125171, Moscow, 


u/b 99, Russia 


As noted above, several email messages were received as a result of this 
transaction. The following IP addresses were obtained from the header 
information from the email messages: 


First Email 

Messaqe from 


IP Address: 1 
Domain Name : 

1 (b)(3): 18 U S C. § 3509(d) Child victims' and 
child witnesses' rights,(b)(3): 1 8 U.S.C § 3509 
Ifdl fFederal Victims' Protection and Riahts Act 



Registrant: VELDEX 

CustName : knutov . net 

Address: Kreesanov st. 6, Perm, 

614000, Russia 

Second Email 

Message from 1 IT.i.'".;, 

: ' 


IP Address: 
Domain Name : 

I (b)(3): 18 U.S.C. § 3509(d) Child victims' and child 
witnesses' rights,(b)(3):18 U.S.C. § 3509(d) 

1 (Federal Victims' Protection and Riahts Act).(b)(6) ( 


Registrant : 

| (b)(6), (b)(7)(C) 


OrgName : 
Address : 


HostDime.com, Inc. 

189 South Orange Avenue, 


], Humble, TX 77338 


Suite I I. Orlando, FL 32801 
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Investigation continues. 
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TECS ACCESS CODE [£] 


CASE NUMBER £ 


TITLE:" COMMERICAL CP WEBSITE KNOWN 


CASE STATUS: 

INTERIM RPT 



REPORT DATE 

DATE ASSIGNED 

PROGRAM CODE 

REPORT NO. 

072808 

051706 

- 

LEJ 

026 

RELATED CASE NUMBERS: | (b)(7)(E) | 


COLLATERAL REQ: 


TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 


TOPIC: JULY 16, 2008 PURCHASE AT 


SYNOPSIS: 

In April 2006, Immigration and Customs Enforcement (ICE) , Cyber Crimes Center 
(C3 ) , Child Exploitation Section (CES) , initiated an investigation into an 
international criminal organization operating numerous commercial child 
exploitation websites. The investigation has been titled Project Flicker. 

The investigation is currently being worked by ICE/C3/CES, ICE/Resident 
Agent -in- Charge (RAC) Birmingham, the U.S. Postal Inspection Service (USPIS) , 
the Federal Bureau of Investigation (FBI), the United States Attorney's 
Office for the Northern District of Alabama, and the Department of Justice 
(DOJ) Child Exploitation and Obscenity Section (CEOS) . 


(b)(7)(E) 


DISTRIBUTION: 

SIGNATURE: 


1 (b)(6). (b)(7)(C) 1 SENIOR SPEC AGENT 



APPROVED : 

| (b)(6), (b)(7)(C) | SENIOR SPEC AGENT 

ORIGIN OFFICE: KS 
HQ CHIEF, CYBER CRIM 

TELEPHONE: 7 03 29l w '7A u ' l "l 

TYPIST: 1(b)(6) (b| 
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CASE PROGRAM CODES: 


(b)(7)(E) 
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DETAILS OF INVESTIGATION 


In April 2006, Immigration and Customs Enforcement (ICE) , Cyber Crimes Center 
(C3) , Child Exploitation Section (CES) , initiated an investigation into an 
international criminal organization operating numerous commercial child 
exploitation websites. The investigation has been titled Project Flicker. 

The investigation is currently being worked by ICE/C3/CES, ICE/Resident 
Agent -in- Charge (RAC) Birmingham, the U.S. Postal Inspection Service (USPIS) , 
the Federal Bureau of Investigation (FBI), the United States Attorney's 
Office for the Northern District of Alabama, and the Department of Justice 
(DOJ) Child Exploitation and Obscenity Section (CEOS) . 

Project Flicker has identified a criminal organization that is operating in 
excess of 150 different member restricted child exploitation websites. The 
criminal organization e mployed various PayPal accounts to process th e monthly 
subscription payments. | (b)(7)(E) | 


(b)(7)(E) 


The investigation has uncovered at least two distinct payment websites 
utilizing by the criminal organization to collect subscriber payment 
information. The first, iWest, was in operation from approximately July 2006 
to September 2007. The iWest payment method primarily utilized the 14 PayPal 
account discussed above. The second, D.A. Pay or D.A. Technologies, was 
first seen in May 2007 and is still in operation. This method utilizes 
traditional merchant accounts. The following merchant accounts have been 
identified: GEO LOCATOR, PRIVATE CONNECT, MULTICARDS.COM, and VPNSERV-CA.COM. 

On July 16, 2008, an ICE agent assigned to the Cyber Crimes Center (C3) , 

Child Exploitation Section (CES) 
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exploitation advertising websites 


essed a chrld exploitation we bsite 
7\. The website was entitled 14^' 

served as a portal to several child 
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(b)(3): 18 U.S.C. § 3509(d) Child victims 1 
and child witnesses' rights, (b)(3): 18 
U.S.C. § 3509(d) (Federal Victims' 
Protection and Rights Act) 


On the same date the ICE 
website known 

I. (B)(3)! 18 U.S.U. &35Uy(fl) Lftllfl 


ig ent clicked the hyperlink for the advertising 

r^, r i eCt ;g e t f o1 lowlng text was excerpted 


(FRflRrnl Victims' Pmlp.iHinn nnrt Rinhla Afl) 


from the webpage displayed at the above listed URL: 


3 “ 


^ J .u,l - real high-quality photo site for those who love pure natural 
beauty locked in the curves of a child body." 


"Only real full-scale tasteful nude pics. Innocent but lustful, beautiful 
and though provoking, shy but .... naked. " 


"Best galleries of youngest girls chosen from whole archive of our studio. 
We collected big archive of lolitas photos within last 3 years, and now we 
bring you selected galleries of youngest of them." 


In addition, the webpage contained approximately 25 images depi c t ing 

I (b)(3): 1 8 U.S.C. § 3509(d) Child victims' and child witnesses rights.(b)(3): 18 U.S.C. § 3509(d) (Federal Victims' Protection and Rights Act) I . The ittiaqeS 

ri-pH I ' iU!aL ^ 3!iuij(ii) LH i u M i ms dn,j,: i i ii j.,w i i„^ nj i is (b)(3) loUbL iJ5uy(JMheJe i d i | The J phnaap also 

depicted I Vii-tims' Prntprtinn nnrt Rmhts Aril I' 1 ne WeDpage aiSO 

contained the following hyperlinks: Members Area; Join Now; Free Tour and 
Support . 


On the same date, the ICE agent clicked the Free Tour hyperlink, which 

redirected to | lu ^ ^ " — 1 » I . The 

following text was excerpted from the webpage: 


"It's not easy for use but we're trying to show you the best. And we can 
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proudly say that we're doing it now!" 


"This site was made by us for you - real lovers of young innocent bodies . " 

In addition, the webpage contained approximately 25 images depic ting 

I (b)(3): 1 8 U.S.C. § 3509(d) Child victims’ arid child witnesses' rights (b>(3>: 18 U.S C § 3509(d) (Federal Victims' Protection and Rights Act) I. The images 
I JbU y (d)Lhl | dvl ^ I, jbUy,dl [hederal I T , ' hn . np 

aepiccea | vimm^ Prm.ri.nn .nrt R,nh. c An\ |- i ns weopage aiso 

contained the following hyperlinks: Members Area,- Join Now; Free Tour and 
Support . 


On the same date, the ICE agent clicked the Join Now hyperlink, which 
redirected to [ ’WW™ u.vu s muhw mim ™ ■* u => 5 I The W ebpage 

contained another JOIN NOW hyperlink, as well as a hyperlink redirected to a 
backup billing system. On the same date, the ICE agent clicked the JOIN NOW 
hyperlink, which redirected to 

I mb ia U .a l a JJuaW umu .iuiih. dim umu ia u i l a !■ ^ hiumum | The page &t the 

listed URL was entitled D. A. Technologies :: Purchase Page {also identified as 
Flash Bill) . The page was a form that had to be completed by the individual 
accessing the page; the form requested payment information to include name, 
address, e-mail, telephone, and credit c ard i nformation. In addition, the 
page indicated the purchase was for ID: ES3 at $99.95 (30 days membership) . 
The page also contained the following e-mail address: 

After completing the form, the ICE agent clicked the SECURE PURCHASE button 
which redirected to 

ses ' rights, (b)(3): 18 U.S.C. § 3509(d) (Federal Victims' Protection and Rig hts Act) [ 

The following text was excerpted from the webpage: 


"YOUR CARD HAS BEEN SUCCESSFULLY AUTHORIZED 
ORDER INFORMATION: " 

"Amount to be charged: 99.95" 

"order id: i mpmwvm I" 


"ATTENTION! ! ! " 


"To protect your privacy and avoid you from being associated with the 
purchased site, Your card will be billed for some computer software." 

"Soon You'll receive a formal email receipt from the software company with 
the details of this payment." 

"Don't ask them about the membership! They think you've really bought their 
software ! " 


"If you are contacted by the billing support or by the staff of that software 
company, you must confirm that you purchased their software product and are 
satisfied with it." 
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"Your Membership Information:" 


(b)(3): If 


" MEMBER ZONE] 

"USERNAME: 

"PASSWORD: , 

"If you cannot access memberzone, please write to 


K.riiW3V1Rllgr- R aKnSMWForta-l 


"For support and billing inquires regarding this order please visit:" 


III (B)(3)! IS O^r^TSO^TTn^lIBTOfflTr'SnCPSm' 

l.,„h lo ihwn i R 1 1 S: r y iCoHar-i 

"or send an email to:" 


j 


(b)(3): 1 8 U.S.C. § 3509(d) Child victims' and child witnesses' rights, (b)(3): 18 U.S.C. § 3509(d) (Federal Victims' Protection and Rights Act), (b)(7)(E) 


"NOTE: you may receive several copies of this message. 


The order information and 


"We've successfully received your order, 
membership credentials are as follows:" 

" Arnoun t : 9 9 95 " 

"Order ID: I jbxsubwx o (b)(7)(E) r 
"PaySite IP: BBT 

"Membership Pla n: 30 Days Memb ership” 

"Your Username: ' ’ 

"Your Password: 

"Members Area URL: [has been shown on the payment page] " 


(b)(6), (b)(7)(C), (b)(7)(E) 


"NOTE: your membership will be activated within a hour. If your password is 
not working, please try it again next hour.." 

m * * * IMPORTANT ! READ THIS CAREFULLY:***" 

"To protect your privacy, your card will formally be billed as a payment for 
a product or service at some lawful online store. The administration of that 
store doesn't know anything about memberships we sold. They really sure that 
you purchased their product." 


"You may receive from D . A. PAY a transaction receipt with the details of your 
payment. A payment purpose and how will it appear on your BILLING STATEMENT 
will also be provided in that email." 
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"Don't be confused by that receipt!" 

"Remember, formally You've just ordered product described in the receipt!" 


"If you are contacted by a billing company or by the mentioned above online 
store, please confirm that you bought their product." 

In a ddition to the above email two identical email messages were received 
from '71 . The following excerpt was taken from one of 

the email messages: 


"NOTE: you may receive several copies of this message. 

"This statement reflects details of order | (b>ce>, tb>c 7>(c>, (b>( 7>(t 

2008-07-16" 

"Order Date: 2008-07-16" 

"Charge Date: 2008-07-18" 

"Charge Type: ONE-TIME {no rebills) " 

"Formally Payment For: DATABASE (noted in yo ur bank reco rds) " 
"Actually Payment For: 30 Days Membership at I I " 
"Amount: USD 99.95" 


^ placed by you on 


"The charge will appear on your card statement as GEO LOCATE." ° 

On the same date, the ICE agent accessed the member restricted website at the 
above listed URL. The website contained approximately 9 rar archive files, 

11 video files, and in excess of 2,900 image files. The image and video 
files depicted I |U,|J) dMUlJ ' llu Iu yuyidl m HU ™ d " u I 

(b)(3): 1 8 U.S.C. § 3509(d) Child victims' and child witnesses' rights, (b)(3): 18 U.S.C. § 3509(d) (Federal Victims' Protection and Rights Act) 


(b)(7)(E) 


Using a publicly available database, the ICE agent was able to determine the 
following information: 


IP Addr e s s 
OrgName : 
Address ; I 


X 


Registrant Contact V | 


Brampton, Ontario, Ca nada 


(Eedscal Vitfims' PrntRtfinn and Rmhts Art) iliiffi) (h)(7)(C) I 


U.S.C. § 3509(d) Child 


Orlando, FL 32803 
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Phone: +4 07301 k 7i u ,'A\ u 'l 
Email: : iy 


IP Address : ][_ 


Owner: NETPLACE 

Address: Tevosyana 40a-89, Electrostal, Moscow Region, Russia 


Registrant : 

IP Address : 

OrgName : netdirekt e.K. 

Address: Kleyer Strasse 79/Tor 14, Frankfurt, 


Vista, CA 92084 
DE 60326 


Registrant : VELDEX 

IP Address: I (b>(6).(b>(7>(c> | 

OrgName : Mccolo Corporation 

Address: 64 East Main Street, Box 275, Newark, DE 


(b)(6), (b)(7)(C) 


IP Address: 

Registrant: 

Descr: McHost.Ru Inc. 

Address: 125171, Moscow, u/b 99, Russia 


Tegelen, 5932, NL 


As noted above, several email messages were received as a result of this 
transaction. The following IP addresses were obtained from the header 
information from the email messages: 

Email Message from 
IP Address : | (b)(s> (b)(7)(C) | 

Domain Name: 1(b)(3) IS U SC f 3505(d) Child victims and child Witnesses! 

Registrant: Network Redux, LLC *® 

OrgName: Network Redux, LLC 

Address: 520 SW 6th Avenue, Portland, OR 97204 


First Email Message from | 

IP Address: I (b>(6>.(b>(7>(c> _ 

Domain Name: 

Registrant: VELDEX 
CustName: knutov.net 
Address: Kreesanov st. 6, Perm, 


fsiho-ifiusr. sasl 


614000, Russia 


Second Emai l Message from 
IP Address : childwit'ne^’'^’ 
Domain Name: ( d >( Fedf 


ights,(b)(3):18 U.S.C. § 3509 
Jims' Protection and Rights 


C f, .350,9111) IFpflprnl Vi I 
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Registrant : Q 
OrgName : 
Address : 


J, Humble, TX 77338 


Orlando, FL 32801 


Investigation continues . 
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TITLE:" COMMERICAL CP WEBSITE KNOWN AS ImeS ^(1” 

CASE STATUS: 

INTERIM RPT 



REPORT DATE 

DATE ASSIGNED 

PROGRAM CODE 

REPORT NO. 

072808 

051706 

LEI 

027 

RELATED CASE NUMBERS: | (b)(7)(E) 







COLLATERAL REQ: 


TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 


SYNOPSIS: 

In April 2006, Immigration and Customs Enforcement (ICE), Cyber Crimes Center 
(C3) , Child Exploitation Section (CES) , initiated an investigation into an 
international criminal organization operating numerous commercial child 
exploitation websites. The investigation has been titled Project Flicker. 

The investigation is currently being worked by ICE/C3/CES , ICE/Resident 
Agent- in- Charge (RAC) Birmingham, the U.S. Postal Inspection Service (USPIS) , 
the Federal Bureau of Investigation (FBI), the United States Attorney's 
Office for the Northern District of Alabama, and the Department of Justice 
(DOJ) Child Exploitation and Obscenity Section (CEOS) . 


(b)(3): 18 U.S.C. § 3509(d) Child victims' and child witnesses' rights,(b)(3):18 U.S.C. § 3509(d) (Federal Victims' Protection and Rights Act), (b)(7)(E) 


DISTRIBUTION: 

SIGNATURE; 


1 ' U)l J A l! ( .^'i ULI '' 'X "in^rnn'end 1 SENIOR SPEC AGENT 



APPROVED : 

Irinhfrq <h»3V1R 1 1 ^ P R ^nQMWF 0 rt 0 r a l Victim.:' Prn.ortmn nndl OE.1N XUK O ir E.C I 

ORIGIN OFFICE: KS 
HQ CHIEF, CYBER CRIM 

TELEPHONE: 703 293 9679 

TYPIST: DUNN 
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DETAILS OF INVESTIGATION 


In April 2006, Immigration and Customs Enforcement (ICE) , Cyber Crimes Center 
(C3) , Child Exploitation Section (CES) , initiated an investigation into an 
international criminal organization operating numerous commercial child 
exploitation websites. The investigation has been titled Project : Flicker . 

The investigation is currently being worked by ICE/C3/CES, ICE/Resident 
Agent -in -Charge (RAC) Birmingham, the U.S. Postal Inspection Service (USPIS) , 
the Federal Bureau of Investigation (FBI), the United States Attorney's 
Office for the Northern District of Alabama, and the Department of Justice 
(DOJ) Child Exploitation and Obscenity Section (CEOS) . 

Project Flicker has identified a criminal organization that is operating in 
excess of 150 different member restricted child exploitation websites. The 
criminal organization e mployed various PayPal accounts to process th e monthly 
subscription payments. 1 (b)(7)(E) | 


The investigation has uncovered at least two distinct payment websites 
utilizing by the criminal organization to collect subscriber payment 
information. The first, .iWest, was in operation from approximately July 2006 
to September 2007. The iWest payment method primarily utilized the 14 PayPal 
account discussed above. The second, D.A. Pay or D . A . Technologies, was 
first seen in May 2007 and is still in operation. This method utilizes 
traditional merchant accounts. The following merchant accounts have been 
identified: GEO LOCATOR, PRIVATE CONNECT, MULTICARDS.COM, and VPNSERV-CA.COM. 


On July 16, 2008, an ICE agent assigned to the Cyber Crimes Center (C3) , 
Child Exploitat ion Section (CES) acce ssed a child exploitation we bs it ^ 

The website was entitled 'ESSE 

Ichiid witnesses' rights fbH3v i s u.s.c. s 3509(1 . " The website served as a portal to several child 
exploitation advertising websites: 
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(b)(3): 18 U.S.C. § 3509(d) Child 
victims' and child witnesses' rights, (b) 
(3): 18 U.S.C, § 3509(d) (Federal 
Victims' Protection and Rights Act) 


On the same date the ICE agent clicked the hyperlink for the advertising 
website known as Euro Lolas, which redirected to 
| iBju)iittu.s.L.6J5uaia)Lh.iav.«M AnamaMMUH WW) lousu ^suuia) | Th fnl 

I fFartarnl Vittinra' Prnrartinn nnil Rinhl-. flrti \- lne J-OlIOWing CeXC Was eXCerptea 

from the webpage displayed at the above listed URL: 


..I (b)(3): 18 U St. § |„ 
I 3508(d) Child Yistima' I 


"Inside You will see very special moments of young nymphets" 

"Welcome to - very hot web site. The Goddess of Beauty and Youth 

makes us think of Harmony of this wonderful World!" 


In addition, the webpage contained approximately 15 images depi c t ing 

I (b)(3): 18 U.S.C. § 3509(d) Child victims' and child witnesses' rights, (b)(3): 1 8 U.S.C § 3509(d) (Federal Victims' Protection and Rights Act) I. The images 

rhprl I tb)w U b L ^ j!)Uy ' d > ' - hl l d viclim5 an ' j chi l d witnesses rights tb)(3) l o U b L. ^ JbUHtd) (Federa l I m h - ' u n -„. --.-I: 

oepiccea I Vu-nm-V Prntprtmn .mil Rinhl-, Art) I- 1 ne WeDpage aiSO 

contained the following hyperlinks: Members Area; Join; Tour and Support. 


On the same date, the ICE agent clicked the Tour 
| (BHjy ia u.s.u. 4 35uy(d) umia victims ana anna witnesses rignrs. (B)(3)! la u.s.u. 4 35uy(a) (i-seerai v 

UO | Prntprtinn and Rinhts Aril 

excerpted from the webpage: 


hyp erlink, which redirected 
_J. The following text was 


"Stay with us! We are sure You will get lots of pleasure if You become our 
member. " 


In addition, the webpage contained approximately 18 images depic ting 

I (b)(3): 18 U.S.C. § 3509(d) Child victims' and child witnesses' rights. (b)(3): 18 U.S.C § 3509(d) (Federal Victims' Protection and Rights Act) I. The images 

depicted 1 WW! Ia u b L s J3Ubl > a > Ln " a Ia u b - L s ii-eaerai — The webpage also 
contained the following hyperlinks: Members Area; Join; Tour and Support. 
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On the same date, the ICE agent clicked the Join Now hyperlink, which 

to I (b)U): l« u y LT'§'35U!^a> Uffildv.ct.ms and child witnesses nghts (b|(J) V6 U b L ^ dbliytfrthedersl I Th _ W pKr>aflA 

redirected to | ^ P,^nH p,n h .. I- J- ne wenpage 


Vil-timc’ Prnloi-Hnn unH Pinhts fli _ _ 

contained another JOIN NOW hyperlink, as well as a hyperlink redirected to a 
backup billing system. On the same date, the ICE agent clicked the JOIN NOW 
hyperlink, which redirected to 

I I'&.ui.l i Mill u, III .aim, . M .-S 5 , H |,U.„.U , Tha page a( . the 

listed URL was entitled D . A. Technologies :: Purchase Page (also identified as 
Flash Bill) . The page was a form that had to be completed by the individual 
accessing the page; the form requested payment information to include name, 
address, e-mail, telephone, and credit card information . In addition, the 
page indicated the purchase was for ID; n)°w“1 at $79.99 (30 days membership). 
The page also contained the following e-mail address-. I ^17 , 

After completing the form, the ICE agent clicked the SECURE PURCHASE button 
which redirected to 

| (b)(3): 1 8 U.S.C. § 3509(d) Child victims' and child witnesses' rights, (b)(3): 18 US C § 3509(d) (Federal Victims' Protection and Rights Act) | 

038. The following text was excerpted from the webpage: 


"YOUR CARD HAS BEEN SUCCESSFULLY AUTHORIZED 
ORDER INFORMATION : « 

"Amount to be charged: 79 .99" 

"Order ID: l (b>(6> (b>(7>(C) (b)(7>(e> j » 


"ATTENTION! ! ! " 


"To protect your privacy and avoid you from being associated with the 
purchased site, Your card will be billed for some computer software." 

"Soon You'll receive a formal email receipt from the software company with 
the details of this payment." 

"Don't ask them about the membership! They think you've really bought their 
software ! " 


"If you are contacted by the billing support or by the staff of that software 
company, you must confirm that you purchased their software product and are 
satisfied with it." 


"Your Membership Information.-" 

"MEMBERZONE: | ww 
"USERNAME; 

"PASSWORD: 


(b)(6), (b)(7)(C), (b)(7)(E) 


ideal VirtimV Prntprtinn nnrl Biotas Arti 


"If you cannot access memberzone, please write to 


"For support and billing inquires regarding this order please visit:" 
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(b)(6), (b)(7)(C), (b)(7)(E) 


"NOTE: you may receive several copies of this message." 

"We've successfully received your order. The order information and 
membership credentials are as follows : 11 

" Amount : 7 9 ■ 99" 

"Order ID: I I" 

"PaySite T rl | 

"Membership Pla n: 30 Days Memb ership" 

esses; l " 

"Members Area URL: [has been shown on the payment page] " 

"NOTE: your membership will be activated within a hour. If your password is 
not working, please try it again next hour. " 

« * * * IMPORTANT ! READ THIS CAREFULLY:***" 

"To protect your privacy, your card will formally be billed as a payment for 
a product or service at some lawful online store. The administration of that 
store doesn't know anything about memberships we sold. They really sure that 
you purchased their product." 

"You may receive from D.A. PAY a transaction receipt with the details of your 
payment. A payment purpose and how will it appear on your BILLING STATEMENT 
will also be provided in that email." 

"Don't be confused by that receipt!" 

"Remember, formally You've just ordered product described in the receipt!" 

"If you are contacted by a billing company or by the mentioned above online 
store, please confirm that you bought their product." 

In a ddition to the above emai l two identical email messages were received 
from I I . The following excerpt was taken from one of 
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the email messages : 


"NOTE: you may receive several copies of this message." 

"This statement reflects details of order # | (b>(6) (b)(7>(c>(b>(7>(e>~~| placed by you on 
2008-07-16" 

"Order Date: 2008-07-16" 

"Charge Date.- 2008-07-18" 

"Charge Type: ONE-TIME (no rebills) 11 

"Formally Payment For: PRIVATE NETWORK (note d in your ba nk records) 11 
"Actually Payment For: 30 Days Membership at p i 0 

"Amount: USD 79.99" 


"The charge will appear on your card statement as PRIAVTE. 


On the same date, the ICE agent accessed the member restricted website at the 
above listed URL. The website contained in excess of 10,000 imaqe files. 

Thf=. imanP | WTOT PIWTOS ^ Mg ^5555 nght (Ltf) TW5T g BbUifldj (Federal | 

' ■ ThG £lleS de P 1Cted I nu« . . s r r . ^ . na B . nh, a a m I 


3- 


(b)(7)(E> 


Using a publicly available database, the ICE agent was able to determine the 
following information: 

I (b)(3): IS U S C 5 3505(d) Child I 

Lflctima: and child aataflaaaa .nnhil . 

IP Address : | (b>( 6 >,(b>( 7 >(c> | 

OrgName : Rep . net 

Address: Unite 13, 1 Delta Park, Brampton, Ontario, Canada 

Real sl-ranf rnntart- I W) Juuuu) l i i ii j jiiij ii ym , ibid re i 

Registrant contact. | 1 1 ,s r. r. asnami iFpi1pi.ii vu-nmv Pmipmm nn<i Rmim Am I ,, 

|lBp)! iau sr^j3uyia) lhih | 

IP ° AddressT V (b)( 6 ), (b)( 7 )(C) 1 

Registrant: VELDEX 
Owner: Optynex Telecom 

Address: Guillermo Peterkin, Calle 50 y 53, Edificio Plaza 2000, Piso 9, 
0832, Panama 





i 

(b)(6), (b)(7)(C) 

|. Orlando. FL 32803 

Phone : 

+407301 l 7-i°/rT 1 


Email : 

■ io u.o.u. 9 oJu^iu, L.MHU 
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IP Address: | (b)(6), (b)(7)(c) | 

Owner: NETPLACE 

Address: Tevosyana 40a-89, Electrostal, Moscow Region, Russia 


| iujijj. 14 u.s.u 9 juuaiu; urmu | 

Registrant : I (b)(6), (b)(7)(C) |, vista, CA 92084 

IP Address: I (b)(6), (b)(7)(C) ] 

OrgName : netdirekt e . K . 

Address: Kleyer Strasse 79/Tor 14, Frankfurt, DE 60326 


(B)(3V IB U.y.U. 6 35Uy(fl) LMfl 


Registrant : 

VELDEX 

IP Address: 1 

1 (b)(6), (b)(7)(C) 1 

OrgName: McColo Corporation 

Address: 64 

East Main Street, Box 275, Newark, DE 

| (B)(3)! 18 U.y.U. ^ 35Uy(fl) Lhllfl I 

IP Address: 

(b)(6), (b)(7)(C) 1 

Registrant: 

(b)(6), (b)(7)(C) | 


Descr: McHost.Ru Inc. 

Address: 125171, Moscow, u/b 99, Russia 


Tegelen, 5932, NL 


As noted above, several email messages were received as a result of this 
transaction. The following IP addresses were obtained from the header 
information from the email messages: 


Email Messa ge from [/!? 
IP Address : \ 

Domain Name 
Registrant : 




(b)(3): l ij U.ij.U. i) JbUUld) Chi l d vicl.ms and ch. l d I 
mum .In II .SC. ,S .m^tlWF.Brift.1 


.... . r| g h 's (D 

(3): 1 8 U.S.C. § 3509(d) (Federal Victims' Protection and Rights Act) (b) 
IB) WRKC) 


North Yorkshire, 

NetName: Webmania 
Address: 13 Mount Parade, York, North Yorkshire, Y0244AP, UK 


Y0244AP, UK 


First Email Message from 


§ 3509(d) Child 
ies' rights, (b)(3): 18 U.S.C. § 3509(d) (Federal 
s' Protection and Rights Act), (b)(G), (b)(7)(C) 


IP Address: 

Domain Name 

Registrant: Whois Privacy Protection Services 
OrgName : FeBox LLC 

Address: 65 Cheyenne Street, Tinton Falls, NJ 07712 


IP Address: I 1 
Domain Name : 


u.s.e.sm(d)cyteHn n cPf 

' rights, (b)(3): 18 U.S.C. § 3509 1 

itims' Protection and Rights Act! 


Registrant: VELDEX 
CustName: knutov.net 
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AddressT | (b)(6), (b)(7)(C) | , 614 000, Russia 


Investigation continues. 
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CASE NUMBER I (b)(7)(E) I 


TITLE: COMMERICAL CP WEBSITE KNOWN AS 1(b)(3): is use s 3509(d) chiidvl 
CASE "STATUS": INTERIM RPT 


REPORT DATE 


| DATE ASSIGNED 

PROGRAM CODE 1 

REPORT NO. 

072808 


051706 

en 

028 

RELATED CASE 

NUMBERS : 1 

1 



COLLATERAL REQ : 


" TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 


I 




TOPIC: MEETING IN KYIV, UKRAINE 

- MAY 7, 2008 

SYNOPSIS : 



In April 2006, Immigration and Customs Enforcement (ICE) , Cyber Crimes Center 
(C3) , Child Exploitation Section (CES) , initiated an investigation into an 
international criminal organization operating numerous commercial child 
exploitation websites. The investigation has been titled Project Flicker. 

The investigation is currently being worked by ICE/C3/CES , ICE/Resident 
Agent- in- Charge (RAC) Birmingham, the U.S. Postal Inspection Service (USPIS) , 
the Federal Bureau of Investigation (FBI), the United States Attorney's 
Office for the Northern District of Alabama, and the Department of Justice 
(DOJ) Child Exploitation and Obscenity Section (CEOS) . 


This report will document a meeting that occurred in Kyiv, Ukraine on May 7, 
2008 and provide an update of the international enforcement activity by the 
Republic of Belarus. 


DISTRIBUTION: 

SIGNATURE: 


1 (b)(6) (b)(7)(c“ | SENIOR SPEC AGENT 



APPROVED : 

1 (b)(6),(b)(7>7c7 ” 1 SENIOR SPEC AGENT 

ORIGIN OFFICE: KS 
HQ CHIEF, CYBER CRIM 

TELEPHONE: 703 2 9l(b)(6),(b)(7)| 

TYPIST: 1(b)(3) (b| 
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DETAILS OF INVESTIGATION 


In April 2006, Immigration and Customs Enforcement {ICE) , Cyber Crimes Center 
(C3), Child Exploitation Section (CES) , initiated an investigation into an 
international criminal organization operating numerous commercial child 
exploitation websites. The investigation has been titled Project Flicker. 

The investigation is currently being worked by ICE/C3/CES, ICE/Resident 
Agent -in -Charge (RAC) Birmingham, the U.S. Postal Inspection Service (USPIS) , 
the Federal Bureau of Investigation (FBI), the United States Attorney's 
Office for the Northern District of Alabama, and the Department of Justice 
{DOJ) Child Exploitation and Obscenity Section (CEOS) . 

Project Flicker has identified a criminal organization that is operating in 
excess of 150 different member restricted child exploitation websites. The 
criminal organization e mployed various PayPal accounts to process th e monthly 
subscription payments. | (b)(7)(E) | 


(b)(7)(E> 


ICE and the FBI have been working with Warrant Officer I (b>(G> (b)(7)(C) ~| of the 

Ukrainian Ministry of Internal Affairs (MIA) since August 2007. In October 

2007, ICE and FBI representatives attending a meeting betwe en the US, 

Belarus, and the Ukraine in Kyiv, Ukraine; please see ROI # 1 (b)(7)(E) | 

for background and additional information. 

On May 7, 2008, a meeting was held at the Ukrainian Ministry of Internal 
Affairs headquarters to further the discussion on Operation Flicker/Operation 
Tornado. The following individuals were present for the meeting: 

Warrant Officer I (b>(6> (b)(7)(C) | , MIA/Ukraine 

| (b)(6), (b)(7>(c> 1 , MIA/Ukraine 

Special Agent I (b)(6) (b)(7 )( c) |, FBI /IIU 

Special Agent | (b) i: s> (b):?i(Cj | , FBI/Legat/Kyiv 
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Special Agent I (b>(6>,(b>(7>(c> 1 ICE/At tache/ Frankfurt 

Senior Special Agent | (b)(6), (b>(7)(c> ] , ICE/C3/CES 


WO I (b)(6), (b)(7)(cTI provided a chart of 16 individuals identified by ICQ name and 
number (only four of w hich have been iden tified by their actual name) . The 
leader o f the group is I (b)(G )(b pjcj I. a webmaster who uses the ICO name 

(b)(6), (b)(7)(c) | and ICQ number I (b)(6), (b)(7)(C) | . | (b)(7)(E) | 

(b)(7KE) | . The phone activity related to the operation of 

the child exploitation websites has been min imal, but the activity did 
increase during the month of April 2008. WO I (b)(6), (b)(7)(c> | believed the reduced 
activity was due to the enforcement action taken by the Belarusians in 
January 2008. (Three individua ls were ar rested in Bela rus in Janua ry 2008 
related to this Operatio n) . WO I (b>(6>, (b)(7)(C) indicated that | (b)(6), (b)(7>(c> had a 

direct relationship with 1 (bx6MbK7)(C) the main subject of the Bela rusian 

investigation. Currently I (b)(6), (b)(7)(C) | is still on the run. | (b>(6>, (b)(7)(C) | also 
maintains a legitimate computer sales business and a website at rix.com.ua. 

According to WO I (bxeMb^xo ~~1 ICO na me and ICQ number [(b)(6), (b)(7)(c>| 

is one of the high level webmasters, foxs) (b)(7)(C)! an d one of the other high level 
webmasters (name unknown - but known by ICQ name | (b)(6),(b)(7)(cT| and ICQ number 
| (b)(6), (b)(7)(C) 0 have several subordinate webmasters working for them. Takeoff's 
name is believed to be (nickname I '7^ t . 

WO | (b)(6), (b)(7)(cTI indicated that the following members are responsible for the 
advertising websites: 

ICQ Name ICQ Number 

(b)(6), (b)(7)(C) 


WO | (b)(6) .(b)(7)(c)~| advised that | (b)(6) (b)(7)(C) | o perates approximately 22-24 

advertising/member websites ; I (bX6),(b)(7xc) | oper ates approximately 10-12 
advertising/member websites; and | (b)(6) (b)(7)(C) | operates approximately 10-12 
advertising/member websites. 

WO I (b)(6) (b)(7)(c) I related that there are four teams within this organization: lW( B M b ?l 

I (b)(6), (b)(7)(c) I . and the fourth t eam was th ought to be the 

|(bX6Mb)(7)(C) | (responsible for the LS websites) . WO | (b)(6),(b)(7)(cTl provided the 
following individuals were also members of the organization; 

| (b)(6) (b)(7)(c) | (ICQ name I (b)(6), (b)(7)(C) | and ICQ number I (b)(6>,(b)(7)(C) |) : responsible 

for advertising websites/ works for I (b)(6). (b)(7)(c) | . | (b)(6) (b)(7)(C) | is a Belarusian 

national but currently resides in the Ukraine. 
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ICQ name I Wk 7A 1Jn,j I and ICQ number | (b)(6>, (b)(7)(C) ~f | sells child exploitation content to 
other members of the organization; it is believed he either operates or knows 
someone who operates a studio. 


ICQ name and ICQ number I (bxs>.(b)(7>(c> | : also known as I l °, 7 »A 0) I; maintains the 
organization's billing systems. He previously worked for | (b>(B>(b>(7>(c> l and 
specializes in cryptography. 

I (b)(6), (b)(7)(c) I (ICQ name | (b)(6), (b)(7)(cTl ) : married to I (b>(B> (b>(7>(c> | and acts as a 

translator for the organization. 

ICQ name I (b>(S).(b>(7>(cn and ICQ number | (b>(6>,(b>(7>(c>~| : also known as I ' UA 7A UA,< I; webmaster and 
a member of the Kingdom Team. 

ICQ name Fhs), ( b)(7)(c>| and ICQ number 1 (b>(6>,(b)(7xcn i also known as |(b>(B>.(b>(7>(c>| ; webmaster 
for over 20 websites and is a member of the Kingdom Team. 

ICQ name | | and ICQ number | cb><6>,<b>(7>(c> | ; webmaster on the | (b>(B>.(b>(7>(c> lan d it 

is believed that he operates his own group separate from the | (b>(6>.(b>(7>(c> ~| 

organization. 

WO | (b)(6),(b)(7)(c) | advised that the illegal proceeds from the child exploitation 
websites are laundered through a number of Webmoney accounts. These account s 
are operated by an organized crime group that is separate from | (b)(6), (b)(7)(c) | 

group . 

WO | (b)(6) (b)(7)(cTl provided the following list of w ebsites an d team associations 
(additional teams have been identified by WO | (bxs> waxc)"! ) : 

| (b)(6) (b)(7)(C) | : 


(b)(3): 18 U.S.C. § 3509(d) (Federal 
Victims' Protection and Rights Act) 
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Child victims' and child 
witnesses' rights,(b)(3):18 
U.S.C. § 3509(d) (Federal 



It has also been learned that Belarus has arrest ed a total of five people, 
with several outstanding warrants . WO | (b>(6>,(b)(7>(c>~| indicated that he would 
continue his investigation through the summer of 2008 . 

Investigation continues. 
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TOPIC: UPDATE ON BELARUSIAN ENFORCEMENT ACTIVITIES AND CRIMINAL CASES 


SYNOPSIS: 

In April 2006, Immigration and Customs Enforcement (ICE), Cyber Crimes Center 
{ C3 ) , Child Exploitation Section (CES) , initiated an investigation into an 
international criminal organization operating numerous commercial, child 
exploitation websites. The investigation has been titled Project Flicker. 

The investigation is currently being worked by ICE/C3/CES, ICE/Resident 
Agent- in- Charge (RAC) Birmingham, the U.S. Postal Inspection Service (USPIS) , 
the Federal Bureau of Investigation (FBI), the United States Attorney's 
Office for the Northern District of Alabama, and the Department of Justice 
(DOJ) Child Exploitation and Obscenity Section (CEOS) . 


This report will provide an update of the international enforcement activity 
and criminal proceedings by the Republic of Belarus. 
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DETAILS OF INVESTIGATION 


In April 2006, Immigration and Customs Enforcement (ICE) , Cyber Crimes Center 
(C3), Child Exploitation Section (CES) , initiated an investigation into an 
international criminal organization operating numerous commercial child 
exploitation websites. The investigation has been titled Project Flicker. 

The investigation is currently being worked by ICE/C3/CES, ICE/Resident 
Agent -in- Charge (RAC) Birmingham, the U.S. Postal Inspection Service (USPIS) , 
the Federal Bureau of Investigation (FBI), the United States Attorney's 
Office for the Northern District of Alabama, and the Department of Justice 
(DOJ) Child Exploitation and Obscenity Section (CEOS) . 

Project Flicker has identified a criminal organization that is operating in 
excess of 150 different member restricted child exploitation websites. The 
criminal organization e mployed various PayPal accounts to process th e monthly 
subscription payments. I (b)(7)(E) | 


The following is an excerpt of a message from Interpol Minsk regarding 
Operation Tornado. None of the grammar or spelling has been altered from the 
original message. 

BEGINNING OF EXCERPT: 

Herewith we are pleased to provide some extra information in relation to 
Operation Tornado and organizers of the criminal group originating from 
Belarus, their arrests, criminal case initiated etc. 

Upon investigation the criminal case related to Operation Tornado, High-Tech 
Crime department and Investigative department of the Ministry of the Interior 
found that criminal organization acted in Minsk from the middle of the year 
of 2006 till January 2008. This organization was involved in advertisement 
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and distribution of child porno via Internet, thefts by means of computers 
and networks as well .as illegal business activities. 


Before July 2006, Belarusian nati onals I (b>(6>,(b>(7>(c> | dob, 

| (b)(6), (b)(7)(C) 1 dob, | (b>(6> (b>(7>(c> | organized a 

criminal group with a view of illegal activities. Functions of the group 
members : 

-Group leader | (b)(6), (b)(7)(C) | coordinated criminal activities, maintained 

discipline, dis tributed profits, controlled financial flows; 

- | (b)(6), (b)(7)(C) ~1 created and maintained web sites with child porno with 

pre-paid access; 

\ (b)(6), (b)(7)(C) | was involved in advertisement activities of a/m web sites 

by spam sending . 

Separately from this group, before January 2006 , Belarusian nationals r n 7A Pn/) l 
I (bus) (b)(7)(C) I dob created a criminal group 

with the aim of property theft by means of computers and networks. 

Functions of the group mem bers : 

-Group leader T (b>(6>. (b)(7>(c> [ coordinated criminal activities, maintained 
discipline, supplied required equipment and resources, used to steal property 
to the detriment of foreign Internet shops by means of computers, Internet 
and stolen credit card details; 

- | (b)(6) (b)(7)(C) | and other unidentified persons were also involved in 

similar thefts and selling of stolen property. 

In July-August 2006, leaders of both criminal groups created a new joint 
criminal group. 

-Since this period the group started illegal processing services development, 
electronic payment system development and financial flows distribution and 
money laundering . 

Since the grou p expanded scope of activities, new members were recru ited: in 
October 20 0 6 - I (b>(B> (b>t7>(c> \ on October 200 7 - I (b>ts> (b>c7>cc> [ 

| (b)(6)(b)(7)(c) | dob and I (b>(G> (b>(7>(c> I , | (b)(6) (b)(7)(C) | dob (were involved in 

distribution of child porno) . 

Since July 2 006 -1 (b>(G> (b)(7>ic> | dob, since September 2006 - 

I (b)(6), (b)(7)(c) |, sin ce April 2007 - I rb>cB> (b)(7>cc> | 

dob, I (b)(6) (b)(7)(C) | dob, and others. 

Minor's porno was distributed by means of selling access to relevant web 
sites. In order to provide higher profits, optimize incomes, the following 
procedures have been carried out: 
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-Group of | (b)(6), (b)(7)(c) | created specialized software (billing) , used to get 

and process automatically information from all sites, registered at billing 


system, with further sending of processed information for electronic payments 
via <<PayPal>>, camouflaged as payments for software bought at Internet shop. 
With this aim special sites have been created to demonstrate existence of 
these Int ernet shops; 

-Group of I (b)(6), (b)(7)(C) | used to recruit mainly US nationals to open accounts at 

<<PayPal>> payment system with a view of further re-routing of money flows. 
These recruited peoples did not know about real origin of finan cial flows . 
They re -routed money to some of intermedia te accounts opene d by | ms) ( tonxcTI 
I (b)(6), (b)(7>(cfl using faked documents. After this I (b>(6>,(b>(7xc> ~| could easily 

command finances of both groups. 

A/m nationals also were involved in illegal business acti vities from July 
200 6 till 14.1.2008 in Minsk at Timiaryazeva str, 65, and 1 (b>(s>,(b>(7>(c> | - 

also in Kiev (Ukraine) : 

-provided processing services without license and registration, (processing 
information received from web sites registered at billing system, 
transmission of processed information to electronic payment system 
<<PayPal>>, reception of electronic payments; 

-provided banking services without license of the National bank of Belarus, 
obtained high incomes as a results without paying taxes . 

In July 200 6 | ib) ( G) (b)(7)(C) | by o rder of | ( b>(G> (b>(7> ( c> ~| and support of | lP>i 6 , ) A B>i;) l 

| (b)(6), (b)(7)(c) | and | (b)(6), (b)(7)(C) | created billing called <<Iwest>> and installed 

it at: iwepay.com, physically at compu ter system of th e company <<McColo 
Corpora tion>> (Newark, USA), rented by I (b>(6> (b>(7>(c> |. in Octobe r - 

November 2007 <<Iwest>> billing was improved by | (b>(6>,(b>(7>(c> ~| and 

re-named to <<SafePay>>, and installed at: safepay88.com, physically at 
<<McColo>> computer system. 

Since August 2006?, billing <<Iwest>> was used for payments for minor's 
pornography distribution. 

Since 10.08.2006 till 14.01.2008 51450 transactions have been registered for 
selling of minor's porno and criminal organization obtained income of 5 365 
768, 5 US dollars. 


I (b)is) (b)(7)(C) | committed thefts to the 

detriment of foreign Internet shops, including www.dell.com (total loss 
exceeded 15 000 USD) . 

| (b)(6), (b)(7)(c) | and I (b)(S).(b)(7xc) I used stolen banking cards details 

(illegally obtained) for payments. They also used to produce faked credit 
cards . 
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(b)(6)' (b)(7)(c) ~| used to provide cards details, property required and |Wi b u°H')| 

lun 7A un,, l organi2ed thefts and transportation of stolen property to Belarus . 

Drops were also used for these activities. Stolen property, including DELL 
notebook, digital cameras CANON were sold in Minsk. 

On 23 .01.2 008 criminal case was initiated against I (b>(B> = (b>(7>(c> | and I (b)(6), (b)(7)(c) | 

I '“’jfin 1 1 by Art 285 Part 1 of the Criminal Code of Belarus {creation and 
management of criminal organization), Art. 233 part 3 {illegal business 
activities of criminal organization), Art. 212 part 4 (thefts by means of 
computers by organized group with high- scale income) . 

Criminal case was also initiated against other members of criminal 
organization by similar articles of the Criminal Code of Belarus. 

(b)(6) (b)(7)(C) | 

^bK6)|(b)(7)(C) | are arrested at preliminary prison # 1. | (b)(6),(b)(7)(c> | 

(b)(6) (b)(7)(c) | are wanted with a view of arrest. Other persons have been released 
against a written undertaking not to leave a place of residence. The case 
was forwarded to the Court of Central District of Minsk (20.09.2008 - date of 
the first court proceeding) . 

END OF EXCERPT 

Enforcement action against additional members of the criminal organization is 
still pending in the Ukraine. 

Investigation continues. 
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In April 2006, Immigration and Customs Enforcement (ICE) , Cyber Crimes Center 
(C3) , Child Exploitation Section (CES) , initiated an investigation into an 
international criminal organization operating numerous commercial child 
exploitation websites. The investigation has been titled Project Flicker. 

The investigation is currently being worked by ICE/C3/CES, ICE/Resident 
Agent -in- Charge (RAC) Birmingham, the U.S. Postal Inspection Service (USPIS) , 
the Federal Bureau of Investigation (FBI), the United States Attorney's 
Office for the Northern District of Alabama, and the Department of Justice 
(DOJ) Child Exploitation and Obscenity Section (CEOS) . 


This report will provide an update of the international enforcement activity 
and criminal proceedings by the Republic of Belarus. 
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In April 2006, Immigration and Customs Enforcement {ICE) , Cyber Crimes Center 
{C3) , Child Exploitation Section (CES) , initiated an investigation into an 
international criminal organization operating numerous commercial child 
exploitation websites. The investigation has been titled Project Flicker. 

The investigation is currently being worked by ICE/C3/CES, ICE/Resident 
Agent- in -Charge (RAC) Birmingham, the U.S. Postal Inspection Service (USPIS) , 
the Federal Bureau of Investigation (FBI), the United States Attorney’s 
Office for the Northern District of Alabama, and the Department of Justice 
(DOJ) Child Exploitation and Obscenity Section (CEOS) . 

Project Flicker has identified a criminal organization that is operating in 
excess of 150 different member restricted child exploitation websites. The 
criminal organization e mployed various PayPal accounts to process th e monthly 
subscription payments. I (b)(7)(E) I 


(b)(7)(E) 


The following is an excerpt of a message from Interpol Minsk regarding 
Operation Tornado. None of the grammar or spelling has been altered from the 
original message. 

BEGINNING OF EXCERPT: 

Herewith we are pleased to provide information in relation to operation 
Tornado and convictions of members of the criminal organization covered by 
operation Tornado (in addition to our previous messages) . 

Leader of the criminal organization I i b >i G > ( b >( 7 >( c > I. coordinated 

criminal activities, maintained discipline, supplied required equipment and 
resources, used to steal property to the detriment of foreign Internet shops 
by means of computers, Internet and stolen credit cards details; 
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Nickname : 

Convicted by Court of Central District of Minsk for 12 years of imprisonment 
with property confiscation with extra 5 years prohibition to work as LAN 


admin and servicing of computer systems (p.l art 285 of the criminal Code of 

Belarus - creation of the criminal organization, p.4 art 212 - theft by means 

of computer equipment, p.3 rt 343 - distribution of child pornography) . Date 
of sentencing 14.11.2008. Date of verdict effectiveness - 03.03.2009. 

| (b)(6), (b)(7)(C) | dob; 

Nickname: I (b>(6>.(b)(7>(c> | 

Convicted by Court of Central District of Minsk for 8 years of imprisonment 
with property confiscation with extra 5 years prohibition to work as LAN 
admin and servicing of computer systems (p.l art 285 of the criminal Code of 

Belarus - creation of the criminal organization, p.4 art 212 - theft by means 

of computer equipment, p.3 art 343 - distribution of child pornography). 

Date of sentencing 14.11.2008. Date of Verdict effectiveness - 03.03.2009. 


Convicted by Court of Central District of Minsk for 4 years 1 month of 
imprisonment with property confiscation with extra 3 years prohibition to 
drive the vehicle (p.2 art 285 of the criminal Code of Belarus - creation of 
the criminal organization, p.3 art 343 - distribution of child pornography). 
Date of sentencing 14.11.2088. Date of Verdict effectiveness - 0^.03.2009. 


(b)(6), (b)(7)(C) 

Nickname - : ggj 


□ 


Convicted by Court of Central District of Minsk for 5 years of imprisonment 
with property confiscation (p.2 art 285 of the Criminal Code of Belarus - 
creation of the criminal organization, p.3 art 343 - distribution of child 
pornography). Date of Sentencing 14.11.2008. Date of Verdict effectiveness 
- 03.03.2009. 


| (b)(6), (b)(7)(C) | 

Nickname ■. | (b)(6), (b)(7)(C) | 

Convicted by Court of Central District of Minsk for 5 years of imprisonment 
with property confiscation (p.2. art 285 of the criminal Code of Belarus - 
creation of the criminal organization, p.3 art 343 - distribution of child 
pornography). Date of sentencing 14.11.2008. Date of verdict effectiveness 
- 03.03.2009. 


I 5m fbif7>i-c> I 

Nicknames: ! (b)(6), (b)(7)(C) | 

Convicted by Court of Central District of Minsk for 6 years of imprisonment 
with property confiscation (p.2 art 285 of the criminal Code of Belarus - 
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creation of the criminal organization, p.3 art 343 - distribution of child 
pornography). Date of sentencing 14.11.2008. Date of verdict effectiveness 
- 03.03.2009. 


I (b»6Hb»7«C) \ 

Nicknames: [ (b)(6), (b)(7)(c) | 

Convicted by Court of Central District of Minsk for 4 years and 6 months of 
imprisonment with property confiscation (p.2. art 285 of the criminal Code of 
Belarus - creation of the criminal organization, p.3. art 343 - distribution 
of child pornography). Date of sentencing 14.11.2008. Date of verdict 
effectiveness - 03.03.2009. 


I MB), (b)(7)(C) | 

Nicknames : I (b)(s>, (b)(7)(c) | 

Convicted of Court of Central District of Minsk for 4 years imprisonment with 
property confiscation {p.2. art 285 criminal Code of Belarus - creation of 
the criminal organization, p.3 art 343 - distribution of child pornography). 
Date of sentencing 14.11.2008. Date of verdict effectiveness - 03.03.2009. 


| (W6) tb)t /)c;) | 

Nickname : I (b)(6), (b)(7)(C) | 

Convicted by Court of Central District of Minsk for 4 years imprisonment with 
property confiscation {p.2. art 285 of the criminal Code of Belarus - 
creation of the criminal organization, p.3. art 343 - distribution of child 
pornography). Date of sentencing 14.11.2008. Date of verdict effectiveness 
- 03.03.2009. 


| (b)(6) (b)( 7 )(C) | 

Nickname 1 ( 77 »n f 

Convicted by Court of Central District of Minsk for 4 years of imprisonment 
with property confiscation (p.2 art 285 of the criminal Code of Belarus - 
creation of the criminal organization, p.3 arr 343 - distribution of child 
pornography). Date of sentencing 14.11.2008. Date of verdict effectiveness 
- 03.03.2009. 


c 


(b)(6), (b)(7)(C) 

~ [ (b)(6Hb)( /) j 


Nickname 

Convicted of Court of Central District of Minsk for 3 years imprisonment with 
property confiscation (p.3 art 343 - distribution of child pornography). 

Date of sentencing 14.11.2008. Date of verdict effectiveness - 03.03.2009. 


Head of Criminal organizatio n I (b)(6) (b)(7)(C) I (naicknames : T (b)(6), (b)(7)(c) | , 

Invisible) and his assistant | (b)(6), (b>(7)(c> [ escaped and are wanted at 

national (with a view of arrest) , CIS countries (with a view of arrest) and 
international level. 
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END OF EXCERPT 

Enforcement action against additional members of the criminal organization is 
still pending in the Ukraine. 

Investigation continues. 
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RELATED CASE NUMBERS: 


COLLATERAL REQ: 


TYPE OF REPORT: 
OTHER INFORMATION 


TOPIC: PLACEMENT OF \ *£££. h±T CASE IN PENDING STATUS 


SYNOPSIS : 

In April 2006, Immigration and Customs Enforcement (ICE), Cyber Crimes Center 
(C3) , Child Exploitation Section (CES) , initiated an investigation into an 
international criminal organization operating numerous commercial child 
exploitation websites. The investigation has been titled Project Flicker. The 
investigation is currently being worked by ICE/C3/CES, ICE/Resident 
Agent -in- Charge (RAC) Birmingham, the U.S. Postal Inspection Service (USPIS) , 
the Federal Bureau of Investigation (FBI), the United States Attorney's Office 
for the Northern District of Alabama, and the Department of Justice (DOJ) Child 
Exploitation and Obscenity Section (CEOS) . 


Several members of the criminal organization were arrested in Belarus (see 
Report 030) , Subsequent investigati ve activity reg arding this criminal 
organization was documented in case I w^xe) I (Op Basket) . Collateral 
cases for this case remain open but no further investigative activity is 
anticipated for C3 . As a result this case is being placed in pending status. 
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TOPIC: CLOSING OF CASE 
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All leads on this case have been disseminated and collateral investigations 
closed. 


This case is closed. 
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INVESTIGATIVE FINDINGS 

i 


TOPIC: SPANISH NATIONAL POLICE REQUEST FOR INFORMATION OPS FLICKER i 


SYNOPSIS : 

On April 30,2010, the ICE Attache Madrid received a request for assistance 
from the Spanish National Police (SNP) asking for the final results of the US 
phase of an international child pornography investigation initiated by the ICE 
Cyber Crimes Center's (C3) Child Exploitation Section (CES) in Aj^ril of 2006. 
The investigation code named Operation Flicker in the US, Operation Myosis in 
the UK, and Tornado in Spain and Belarus, focused on member- restricted child 
pornography websites that were accessed through established PayPal accounts on 
the internet . The SNP is planning on taking enforcement action on the Spanish 
portion of the investigation (Operation Tornado) during the latter part of 
May, 2010 and are requesting the results for de-conf liction and 
pre- operational planning. 


ICE Attache Madrid requested the assistance of the Executive Informantion Unit, 
ICE, HQ Office of Investigations in obtaining the enforcement statistics 
requested by the SNP. The results will be forwarded upon receipt. 
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DETAILS OF INVESTIGATION: 

On A pril 30,2010, the ICE Attache Madrid received a request for assistance 
from | (b)(6) (b)(7xc> I . 

Brigada de Investigacion Tecnologica, Cuerpo Nacional de Policia (Spanish 
National Police (SNP)), asking for the final results of the US phase of an 
international child pornography investigation initiated by the ICE Cyber 
Crimes Center's (C3) Child Exploitation Section (CES) in April of 2006 . The 
investigation code named Operation Flicker in the US, Operation |(b)(7)(E) | in the 

UK, and Tornado in Spain and Belarus, focused on member-restricted child 
pornography websites that were accessed through established PayPal accounts on 
the internet. ICE offices throughout the US participated in the initiative 
and as a result, numerous cases were opened, and arrests, seizures, search 
warrants and prosecutions were conducted generating enforcement statistics. 

The SNP is planning on taking enforcement action on the Spanish portion of the 
investigation {Operation Tornado) during the latter part of May, 2010 and are 
requesting the final results for de-conf liction and pre- operational planning 
purposes . 

On May 7, 2010, Project Code 2S2 {Operation Flicker) was queried in TECS II 
and revealed 1,357 case records, and 933 arrest records and seizure records 
associated with the investigation nationwide. The ICE Attache Madrid is in the 
process of sorting the records accordingly in order to p rovide the SNP wi th 
the appropriate requested information. On May 11, 2010, | (b)(6) (b)(7)(C) | , 

National Program Manager of the Executive Information Unit, ICE, HQ Office of 
Investigations was contacted and is obtaining more detailed information 
pertaining to the final arrest/conviction statistics related to Operation 
Flicker. 

Upon receipt of the information, the ICE Attache Madrid will review and forward 
the pertinent results to the SNP as requested. 
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RELATED CASE NUMBERS: 


COLLATERAL REQ: 


TYPE OF REPORT : 
INVESTIGATIVE FINDINGS 


TOPIC: OPERATION FLICKER INFORMATION PROVIDED TO SPANISH NATIONAL POLICE 


SYNOPSIS: 

On April 30,2010, the ICE Attache Madrid received a request for assistance 
from the Spanish National Police (SNP) asking for the final results of the US 
phase of an international child pornography investigation initiated by the ICE 
Cyber Crimes Center's (C3) Child Exploitation Section (CES) in Apri l of 20 06. 
The investigation code named Operation Flicker in the US, Operation 1(b)(7)(E) | in 

the UK, and Tornado in Spain and Belarus, focused on member-restricted child 
pornography websites that were accessed through established PayPal accounts on 
the internet . The SNP is planning on taking enforcement action on the Spanish 
portion of the investigation (Operation Tornado} during the latter part of 
May, 2010 and are requesting the results for de-conf liction and 
pre- operational planning. 

On May 18,2010, the ICE Attache Madrid, after obtaining authorization to 
release the requested information from the Office of the Director, ICE Office 
of Investigations (01), HQ, provided the data to SNP. 
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DETAILS OF INVESTIGATION: 

On A pril 30, 2010, the ICE Attache Madrid received a request for assistance 
from I (b)(6), (b)(7)(C) I. 

Brigada de Investigacion Tecnologica, Cuerpo Nacional de Policia (Spanish 
National Police (SNP)), asking for the final results of the US phase of an 
international child pornography investigation initiated by the ICE Cyber 
Crimes Center's (C3) Child Exploitation Section (CES) in April of ,2006 . The 
investigation code named Operation Flicker in the US, Ope ration 1(b)(7)(E) | i n the 

UK, and Tornado in Spain and Belarus, focused on member- restricted child 
pornography websites that were accessed through established PayPal accounts on 
the internet. ICE offices throughout the US participated in the initiative 
and as a result, numerous cases were opened, and arrests, seizures, search 
warrants and prosecutions were conducted generating enforcement statistics. 

The SNP is planning on taking enforcement action on the Spanish portion of the 
investigation (Operation Tornado) during the latter part of May, 2010 and 
requested the final results for de-conf liction and pre- operational planning 
purposes . „ 

On May 7, 2010, Project Code I I (Operation Flicker) was queried in TECS II 
and revealed that 1,357 case records, and 933 arrest records and seizure 
records are associated with the investigation nationwide. Inquiries specific 
to the commodity codes for Currency /Monetary Instruments and Firearms seized 
were also run in TECS II revealing that to date $294,028.51 US dollars, and 30 
firearms, including one silencer and one hand-grenade have been seized. 

On May 11, 2010, | (b>(G> (b>(7xc> | , National Program Manager of the Executive 

Information Unit (EIU) , ICE, HQ Office of Investigations was contacted and was 
requested to obtain specif i c da ta related to arrests and convictions that 
occurred under project code 

On May 12, 2010, I (b>(G> (b)(7xc> | from EIU provided the ICE Attache Madrid 

with a detailed report breaking down the statistics by fiscal year (since the 
operation's inception), investigating office, criminal arrests (407), 
indictments (328), convictions (334), and administrative arrests (5). 

On May 12, 2010, The ICE Attache Madrid submitted a request to SSA I I 

I (b)(6), (b)(7)(cH , Office of the Director, ICE 01, via email for authorization to 
release the information in connection with the SNP request. On May 14, 2010, 
authorization was granted to the ICE Attache Madrid to release the information 
to the SNP. * 
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On May 18, 2010, the statistical d ata fcr final results per taining to 
Operation Flicker were provided to | (bxs> (b>(7>(C) | . Inspector 1(b)(6), (b I of 

the SNP, Child Protection Unit. 
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TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 


TOPIC: NO FURTHER ACTION REQUIRED 
_____ 

On April 30, 2010, the Spanish National Police (SNP) requested statiscal 
information from the ICE Attache Madrid concerning Opertaion Flicker, a national 
child pornography investigation initiated by the ICE Cyber Crimes Center. The 
SNP in preparation for a similar national operation in Spain, requested the 
information for proper deconf liction and pre-planning purposes. On May 18,2010 
the ICE Attache Madrid provided the requested information to the SNP 

Due to the investigative Judge's decision, the national operation was cancelled 
and each independent case was relegated the each respective judicial disctrict 
throughout Spain for action. No further action is required by the ICE Attache 
Madrid therefore this investigation is closed unless additional information is 
obtained that merits reopening the case. 
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TOPIC: COLLATERAL REQUEST REGARDING | XSgXXtZJSSSXZZL 
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SYNOPSIS: 

On July 24, 2006, the Resident Agent in Charge, Birmingham, Alabama (RAC/BI) 
received a collateral request from the Immigration and Customs Enforcement, 
Cyber Crimes Center (C3) , Child Exploitation Section (CES) , regarding a lead 
from the National Center for Missing and E xploited Children (NCMEC) 
Information from NCMEC related to website, HZ VT* reported 

as offering child pornography. While agents at C3 accessed the above named 
website in an undercover capacity, an additiona 1 advertisi ng webs ite was 

discovered through email solicitation, I Both 

websites offer access to members on ly website I ] « 

Website, I ...... o I redirected payments through a PayPal 

account, listed in the name of | (b>(6>,(b>(7>(c> L Fairfield, 

Alabama . 


The off 
to the 


ice of the RAC/BI is investiga ting I (b>(B> ( b>(7>(c> | for activi ty related 

t arminf wif“h |(b)i.3) lo U S C $ 3bL)y(d) ohild victims and child witnesses lights I 

t'aypai account a^oociacea wicn | jb)i3).is'.'.s.C.^a50Wd) (Federal Yisums' Protection and Rights I' 
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DETAILS OF INVESTIGATION: 


On July 24, 2006, the Resident Agent in Charge, Birmingham, Alabama (RAC/BI) 
received a collateral request from the Immigration and Customs Enforcement, 
Cyber Crimes Center (C3) , Child Exploitation Section (CES) , regarding a lead 


from the National Center for Missing and E xploited Children (NCMEC) . 
Information from NCMEC related to website, L, reported 

as offering child pornography. While agents at C3 accessed the above named 
website in an undercover capacity, an additional advertisina website was 

discovered through email solicitation, L,^ mM.:. 

websites offer access to members on ly we b s i t e I , j, . 

Website, I )° c I redirected payments through a PayPal 

account, listed in the name of | (b>(6> (b)(7)(C) |, Fairfield, 

Alabama . 


ADVERTISING SITE 


K BRnfldti (Fariarnl Vi 


On April 5, 2006, ICE Senior Special Agent (SSA) 

rocoi uorl infAVmaHnn fvnm MOM PC worrav^lnn I WW iou±>o 


received information from NCMEC regarding [ 

s ' JJUi ' w ]». On this same date, SSA 


(D)(3)! IA U.S.L 5 


u\ (U)(3) 
T5u3(a^r 




The website offered SSA | the following: 


Hof th e C3/CES 

which was 


accessed website 


“2-12 y.o. Girls and Boys in video, photo, text content without any censure! 

"ABSOLUTELY ILLEGAL 11 

“REAL" 

"Hardcore Fuck of Little Girls, Brutal Rapes, Sweet Love all that you can 
wont HERE ] " 

(Reference ROI# : I (b)(7)(E) T) 


determined during his initial review of the website that an 

overwhelming about of the . ^SR, i 
pornography, specifically I e mamma l 


(b)(3): 18 U.S.C. § 3509(d) Child vii 


rights,(b>(3): 1 8 U S C. § 3509(d) (Federal Victims' Protection and Rights Act) 


h (himv lfi 1 1 s n 0 ahnarm (Fpiipmi 


after the initial review of website 

]. 


SSA acting in an undercover capacity, clicked 

link for the website, which redirected to 

,|y„|y | 4 I 


'] purchased a membership to the 

website, which provided him access for one month for a fee of $79.95. During 
the membership purchase, SSA r7-S“/A°1 was instructed to provide his name, e-mail 
address, mailing address, telephone, and credit card information. 


On April 6, 2006, 


SSA received an e-mail mes sage 

“u™l regarding his membership to | j; 


from 

l« U.y.U. b 3bUy(d) Child victims' and child 
Iwitnussfis rights fiilfD) In HOC S 3SHS(ri) (Ffirifirnl Vi 
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(b)(6), (b)(7)(C) 


Emeryville, CA 94662 


Organization Name: | (bxsw 
Organization Address: | 

IP Address : | (b)(6), (b)(7)(C) | ' 

OrgName: Altavista Company 

Address: 701 First Ave, Sunny vale, CA 


Registrant Name: I (b)(6), (b)(7)(c) | 

Registrant Address- | 1, NY NY 12345 

Registrant Teleph one: I (bxo (b)(7)(c) I 

Registrant Email: | (b)(6), (b)(7)(C) | 

IP Address : | (b)(6), (b)(7)(C) | 

OrgName: Kennel Accountants, Financial Services 

Address: 26 Barolin Street, Bundab erq, OLD 4670 AU 

OrgTechName : 

OrgTechPhone : (b>(6>,(b>(7>(c> 

OrgTeckEmail : 


On April 6, 2006, SSA acc essed the membe rs onl y website 

utilizing. SSA E™] was unable to capture the 
complete website, however; he was able to capture the following: 


"Softcore" galleries 1 through 6, containing approximately., 900 image 
files depicting prepubescent males and females engaged in sexually 
explicit conduct. 


"Hardcore" galleries 1 and 2, containing approximately 115 image files 
depicting prepubescent males and females engaged in sexually explicit 
conduct . 


* Approximately 300 video files from the "Child Porn" video gallery. 

Together, SSA | 1 °y/ r . t ° ) | , and NCMEC, have identified approximately 171 images files 
from the members only website, depicting victims previously identified by law 
enf orceme nt investigations 

SSA EH determined through publicly accessible databases, that the website, 
is maintained at Genesis2 Networks, located at 
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CASE NUMBER I (b)(7)(E) I 

REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: 001 


4200 Freedom Drive, Charlotte, North Carolina 28208. 


On May 25, 2006, Trial Attorney I (b>(6>, (b)(7)(C) |, U.S. Department of Justice 

(DOJ) , Child Exploitation and Obscenity Section (CEOS) issued a preservation 
request pursuant to 18 U.S.C. 2703(f), requesting that Genesis2 Networks 
preserve the contents of the URL: n c £ £n u o^ □! pending 

issuance of a search warrant. In response to the preservation r equest, 
Genesis2 Netw orks prov ided a Seagate 40Gb hard disk drive (Model I (b)(7)(E) | ; 

Serial Number _ 


ADVERTISING SITE 


child porn" 


received an e-mail message from 

, advertising a website containing "Never seen befor e 

The website URL listed I. SSA 

accessed th e webs ite, which was titled ° I Real Children Porno Pay 


On June 23, 2006, SSA 

I'tBJWTi U.S..U. 1 sasustaj'Lnna'viraims ana cnira 
ai.flnhtAf.UtaV.lS.LL&^aMatdi,'' ' 


Site!" SSA was able to ascertain that the advertising for the website 


contained the same conten t as the adverti sing for website 


following offers from website 


(Reference ROI# 




SSA |'7-SwA D, l noted the 


"2-12 y.o. Girls and Boys in video, photo, text content without any censure!" 
"ABSOLUTELY ILLEGAL" 

"Hardcore Fuck of Little Girls, Brutal Rapes, Sweet Love all that you can wont 
HERE ! " 


On June 23, 2006, after SSA reviewed website f 


(b)(3): I H U.bl.U. ^ 3bU9(d) Child victims 1 and chi l d 1 

mpfiVfi rinhl^faum In l. 1 fi r. (Ffiriernl Virli I 


(b)(3): 18 U.S.C. § 3509(d) Child victims' a 


rights, (b)(3): 1 8 U.S.C. § 3509(d) (Federal Victims' Protection and Rights Act), (b)(7)(E) 


3 “ 


SSA r,7°/A u l purchased a membership to the 

website, which provided him access for one month for a fee of $79.95. During 
the membership purchase, SSA was instructed to provide his name, e-mail 

address, mailing addres s , tel ephone, and credit card information. After 
completing the form SSA was notified that he would receive an e-mail with 

instructions on how to finish his order. 


On June 23, 2006, SSA received an e-mail message from 

the contents of which confirmed his request to 
"join elite child porno paysite." The following information was also listed 
in the e-mail: 


"You've just went through verification step." 

"Your credit card wasn't charged" 

"You are in one step from biggest child porno member zone." 

"To complete registration follow instructions." 
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REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: 001 


"To pay be credit card you need to follow these simply instructions:" 

"1. Open link: I la U b.L. & 33 uu(g) unua victims ana eniia witnesses ngntsj,a)( 3 )' la u.b.L. & isuaifl) (i-eaersi victims 1 pratBetian ana HTgnrs-| „ 

"2. enter your credit card info" 

"3 . wait for login on your e-mail" 


"After that you will receive e-mail with login info to our child porno site. 
Thank you for your patience . " 


"WARNING! ! ! For our and your security 

{[^lUnJ|l4 u _3.L. 9 JJUSjU^U | IIU« | l Lfl'Hi, HI 'll l!l IIIUJWIII lUbbUb 


please e-mail all questions. only to this 
All e-mails that will be Sent to other 


e-mail addresses will be 
On June 23, 2006, SSA PHv i 

| (B)( 3 ) 1 ii use 5 jsuyia; Lnna victims sna enrnf 'Witnesses rignr; (B)( 3 ) 1 k 


"2, which redirected 


(b)(3): 18 U.S.C. § 3509(d) Child victims' and child witnesses' rights (b)(3) 1 8 U SC § 3509(d) (Federal Victims' Protection and Rights Act) 

SSA determined that the webpage at the listed ~ 

The website informed SSA |'7™A l 'l 
mi > 14 u that his signup was 


hyperlink was a PayPal secure payment webpage 
through an e-mail from 
completed and that he could access the website through URL: 
1(0)13)! ra use 4 33U9(a) Lnna rams ana anna witnesses rignts i 


On June 23, 2006, SSA accessed a publicly available database that 

provided registrant information for the given URL- The da tabase provided the 

Lirara '(J fi (Ts (Ffi^rn'rviiail' anC * 


I (b)(3): 18 U.S.C. § 3509(d) (Federal Victims' Protection and Rights I 
| Act) 1 

Organization Name: I (b)(6), (b)(7)(c) | 

Organization Address: I (b)(6).(b)(7)(c> ~| < Mesa, AZ 85203 

IP Address: | (b)(6), (b)(7)(C) | 

OrgName: Inktomi Corporation 

Address: 701 First Ave, Sunnyvale, CA 94089 


I (B)(3)! 18 u.s.u 4 -'3uy(d) uniia victims ana ;m 
llhinv 18 1 1 R n R asnaiil) iFprlpml VirlimV Prnl 

Registrant Name; I 
Registrant Address : 
Registrant Telephone. 
Registrant Email: U r "' 


(b)(6), (b)(7)(C) 


IP Addre 
OrgName; 
Address: 26 Hi 

OrgTechName : [ 

OrgTechPhone : 
OrgTeckEmail : 


■ ? j. v r ,-.l 

-iVitnRflnPji rinhta (h)(3) In LJ S P. S 3.5(131, 


NY NY 12345 


(b)(6), (b)(7)(C) 

Kennel Accountants, Financial Services 

.arolin Street. Bu ndaberg. OLD 4670 AU 
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Northern District of Alabama. The title bar indicated the web page was known 


as " lg iliiT' ';,TJ - Secret members area." The member restricted website 
contained the same content and structure as the member restricted website 


described a bove . Determination was made by SA | (b>(G> (b)(7)(cH along with Inspector 
| (b>(6) (b)(7xo | of the United States Postal Service, that the content of the 

website described contains thousands of images of child pornography. 


Specifically, the site depicts prepubescent minors engaged in sexually 
explicit conduct; to include at least 171 images depicting victims previously 
identified by law enforcement investigations. This content is made available 


to internet users located within the Northern District of Alabama. 


C3/CES requests that RAC/Birmingham open an investigation targeting the 
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CASE NUMBER | (b)(6), (b)(7)(C) | 

REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: 001 


operator (s) of the member restricted website known as " 

including the individual operating the above identified PayPal account. C3/CES 
will remain available to assist and support the RAC/Birmingham investigation. 


This investigation continues. 


OFFICIAL USE ONLY 

THIS DOCUMENT IS LOANED TO YOU FOR OFFICIAL USE ONLY AND REMAINS THE PROPERTY 
OF THE DEPARTMENT OF HOMELAND SECURITY, ICE. ANY FURTHER REQUEST FOR 
DISCLOSURE OF THIS DOCUMENT OR INFORMATION CONTAINED HEREIN SHOULD BE REFERRED 
TO ICE HEADQUARTERS TOGETHER WITH A COPY OF THE DOCUMENT. 


Page 305 of 929 




(b)(7)(E) | 

OFFICIAL USE ONLY 


REQUESTED BY: [ 


DEPARTMENT OF HOMELAND SECURITY 
ICE 


REPORT OF INVESTIGATION 


TECS ACCESS CODE 


CASE NUMBER [ 


TITLE: COMMERICAL CP WEBSITE KNOWN AS HOME COLLECTION 


CASE STATUS: 


INTERIM RPT 


REPORT DATE 

DATE ASSIGNED 

PROGRAM CODE 

REPORT NO. 

080706 

072606 

LKJ 

002 


RELATED CASE NUMBERS: 


COLLATERAL REQ: 


TYPE OF REPORT: 
OTHER INFORMATION 


TOPIC: SEAGATE HARD DRIVE RECEIVED FROM DEPARTMENT OF JUSTICE 
SYNOPSIS: ' 

On July 24, 2006, the Resident Agent in Charge, Birmingham, Alabama (RAC/BI) 
received a collateral request from the Immigration and Customs Enforcement, 
Cyber Crimes Center (C3) , Child Exploitation Section (CES) , regarding a lead 
from the National Center for Missinq and Exploited Children (NCMEC) . 
information from NCMEC related to a websiteT IJl 1 ^ I , 
reported as offering child pornography, 
named website in an undercover cai 


While agents at C3 accessed the above 
website was 


discovered through email solicitation, 

NifiSn^sseA 1 

only website Labia m ai tfj i ,s r. r. asnatm (Eadacai mama: Prniprimn nnri rI 




1 directed payments through Paypal account, 
of Fairfield, Alabama. 


listed in the name of | 

On July 24, 2006, the office of the RAC/BI received one Seagate 40Gb hard 
drive from the United States Department of Justice (DQJ) , Child Exploitati on 

j •*. //orAf' 1 „ i* | lo u.t>u. t douyia) i^nna victims ana cnna witnesses | 

and Obscenity Section (CEOS) m relation to | mh „ am nas s asnaMuLbatai virtimv Pmipninn and rI • 



SIGNATURE: 

j 1 i llllll I^Mlml i i|f'~ T |'r 

| (b)(6), (b)(7)(C) | SPECIAL AGENT 



APPROVED : 

| (b)(6), (b)(7)(C) | RAC -RESIDENT AGENT IN 

ORIGIN OFFICE: BI 
BIRMINGHAM, AL - RAC 

. 

TELEPHONE: 205 73 ' un 7A“ A " 1 

TYPIST: 1 (b)(6), (b)(7)(C) | 
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DETAILS OF INVESTIGATION: 

On July 24, 2006, the Resident Agent in Charge, Birmingham, Alabama (RAC/BI) 
received a collateral request from the Immigration and Customs Enforcement, 
Cyber Crimes Center (C3) , Child Exploitation Section (CES) , regarding a lead 
from the National Center for Missing and Exp loited Children (NCMEC 
Information from NCMEC related to a websi 
reported as offering child pornography. 


websites offer access to members on ly website 

Website, , i u i I dir ected payments through Paypal account, 

listed in the name of I we), (b)(7)(C) | of Fairfield, Alabama. -> 

On July 24, 2006, the office of the RAC/BI received one Seagate 40Gb hard 

dr i v nv, £rom ^ he 0 ar v i ' ed f De P ar ^ nt ° £ alia 

ana obscenity Section (CEOS) in relation to mammae mm !■ 

This website is housed at web-hosting company GENESIS2 NETWORKS, located in 
Charlotte, North Carolina. 

On May 25, 2006, Trial Attorney | (b>(B> (b>(7>(c> | , (DOJ/CEOS) , issued a 

preservation request pursuant to 18 U.S.C. 2703(f), requesting that GENE SIS2 
NETWORKS preserve the contents of the URL : l ^ I, I 

pending issuance of a search warrant. In response to the preservation 
request, GENES IS2 NETWOR KS provid ed a Seagate 40Gb hard drive (Model 
ST340014A; Serial Number CSSZ3) . 

On July 21, 2006, said hard drive was sent via Federal Express by I (b)(6), (b)(7)(c) ~| 

(DOJ/CEOS) to SA Suzanne Prevatte of the office of the RAC/BI, in anticipation 

drive on 

July 24, 2006 via Federal Express. 

On July 28, 2006, a search warrant was obtained in the Northern Distr ict of 
Alabama for the contents of said hard drive (see ROI fl (b)(7)(E) ~| ) • Said 

hard drive is th e subject of search arrest and seizure report, FP&F# 


This investigation continues. 
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PAGE 
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CASE 

NUMBER 1 (b)(7)(E) | 


TITLEi COMMERICAL CP WEBSITE KNOWN AS im^gSU 
CASE STATUS: INTERIM RPT 


REPORT DATE 

DATE ASSIGNED 

PROGRAM CODE 

REPORT NO. 

081006 

072606 


003 


RELATED CASE NUMBERS : | (b)(7)(~ 


COLLATERAL REQ : 


TYPE OF REPORT: 

SEARCH WARRANT REPORT / 


TOPIC: SEARCH WARRANT OBTAINED FOR SEAGATE HARD DRIVE 


SYNOPSIS: 

On July 24, 2006, the Resident Agent in Charge, Birmingham, Alabama (RAC/BI) 
received a collateral request from the Immigration and Customs Enforcement, 
Cyber Crimes Center (C3) , regarding a lead from the National Center for 
Missing and Exploited Chi ldren ( N CMEC ) . Information from NCMEC related to a 
website, I ». I . reported as offering child pornography. 

Agenis at C3 accessed the above named alon 9 

Website, ES SESSSEESSZmI dir ected payments through a Paypal account, 
listed in the name of | (bxs) (b)(7)(G) | of Fairfield, Alabama. 


On July 28, 2006, in the Northern District of Alabama, United States 
Magistrate Judge Robert R. Armstrong, Jr. signed four search warrants, 
commandinq searches related to the investiqation of 

I (b)(3): IB U.B.U. S 3blJsS(d) Child victims' and child witnesses' rights I 
I (b)(3), 18 U.S.C. S 35Qg(d> (Federal Victims’ Prctscticn and Rialto I • 


«■ 1 1 1 1 1 1 II II IM Lil 



| (b)(6), (b)(7)(C) I SPECIAL AGENT 



APPROVED : 

1 (b>(6) (b)(7)(C) 1 RAC -RESIDENT AGENT IN 

ORIGIN OFFICE: BI 
BIRMINGHAM, AL - RAC 

TELEPHONE: 205 73*<K3)*»' , I 

TYPIST: | (b)(6), (b)(7)(C) | 
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CASE 

NUMBER | 

(b)(7)(E) | 


REPORT NUMBER: 003 


CASE PROGRAM CODES: 
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CASE NUMBER 1 (b)(7)(E) | 

REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: 003 


DETAILS OF INVESTIGATION:" 


On July 24, 2006, the Resident Agent in Charge, Birmingham, Alabama (RAC/BI) 
received a collateral request from the Immigration and Customs Enforcement, 
Cyber Crimes Center (C3) , regarding a lead from the National Center for 
Missing and Exploited Children (NC MEC) . Information from NCMEC related to a 
website, 1(b)(3) is use § 3509(d) child victims^ ^ and child witne| ( reported as offering child pornography, 

(b)(6), (b)(7>(C),(b>(7>(E> 

websites offer access to members only webs i t e | %\nVi a 8 ul^V3MTduFeder 
Website, 'Z. I c X T **™* I dir ected payments through 

listed in the name of | (b)(6),(b)(7)(c> | of Fairfield, Alabama. 


^ims and child witnesses rights, I 
aj^ictims^Protectioi^and^Rl^htsJ* 

a Paypai account, 


On July 28, 2006, in the Northern District of Alabama, United States 
Magistrate Judge Robert R. Armstrong, Jr. signed four search warrants, 
commanding searches related to the investigation of 

I (bp); 1 8 U.S.C. § 350S(d)Child wcEms 1 and child witnesses rights, I 3 

Ifh)f3); 1 a U.S.C. S aSQSfdl (Federal Victims' Protection and Riahia Ar 


SEARCH WARRANT #1: 
SEAGATE 40Gb HARD DRIVE 


On May 25, 2006, Trial Attorney □ 


□, United States Department of 


Justice (DOJ) , Child Exploitation and Obscenity Section (CEOS) , issued 
oreservation reauest pursuant to 18 U.S.C. 2703(f), reauesting that GENESIS2 

nrwmnnvo ♦-*,« nD- I !bl! ,0 ! o : ? S C >, yarns ' uml ch. l d 1 

NETWORKS preserve the contents of the URL j mini tmmv i» 1 1 s r: r 3!ins(iiHF8datai,Vtf-iima’.i?miflciiQB l jBijJ 
pending issuance of a search warrant. In response to the preservation 
request, GENESIS2 NETWOR KS provid ed a Seagate 40Gb hard drive (Model 
ST340014A; Serial Number I (b)(7)(E) ~1 ) , which is said to contain the contents of 
the aforementioned website. 


On July 21, 2006, U.S. DOJ/CEOS mailed said hard drive via Federal Express to 
the office of the RAC/BI, for the purpose of securing a search warrant for the 
contents of the drive. RAC/BI received the hard drive on July 24* 2006. 

On July 28, 2006, one of the four search warrants signed by U.S. Magistrate 
Judge Armstrong, was for the search of the above listed hard drive obtained 
from GENESIS2 NETWORKS, of Charlotte, North Carolina. 


On Au gust 2, 2006, custody of said hard drive was relinquished to ICE Special 
Aqentl (b)(6>, (b>(7>(C) | of C3, Child Exploitation Unit (CES) . Transfer of custody 

was evi denced by Customs Form 60 51 I (b)(7)(E) I . and transferred in SEACATS 
(FP&F# : | (b)(7)(E) | ) • 
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CASE NUMBER 


REPORT NUMBER: 003 


IP Address: 69.51.10.160 
GENES IS2 NETWORKS 


On July 28, 2006, 


M agistrate Judge Armstrong signe d a search warrant 
commanding search of URL ^ ( ,bv3v iTus L c\ a 3^ protaLn a'nd Rights I located at web-hosting 

service location GENESIS2 NETWORKS, 4200 Freedom Drive, North Carolina 28208. 


In April and June of 2006 , agents of C3 conducted two u ndercover purchases to 
members only website URL : | .ESmVSSS I (sea ROI# 

I WRKE) D which offers an abundance of child pornography. C3 agents 

retrieved 969 images from the website, of which, members of NCMEC; were able 
to identify 171 image files depicting victims previously identified by law 

pnfnrbpmpnf in\fpgt-iftaHf'ng On Jn1» Od. 7finfi anonl-g oif t- ho Paf/WT alfln 

(b)(7)(E) 


On July 31, 2006, the office of the RAC/BI coordinated with the RAC, 

Charlotte, North Carolina (CR) to effect the search located at GENES IS2 
NETWORKS, 4200 Freedom Drive, North Carolina 28208. The original search 
warrant was mailed to RAC/CR on this same date, via DHL. 

On August 3, 2006, agents of the RAC/CR advised that service of the search 
warrant was executed on this date. Agents seized one hard drive from GENESIS2 
NETWORKS, which will be examined by C3 for contents relating to child 
pornography as defined by as defined in 18 U.S.C. 2256. RAC/CR has forwarded 
the hard drive to agents at C3, and returned the original search warrant to 
the office of the RAC/BI. 

SEARCH WARRANT #3 

YAHOO! INC, regarding the fol lowing URLs and email accounts; 

(b)(3): 18 U.S.C. § 3509(d) Child victims’ and child witnesses' rights, 

(b)(3): 18 U.S.C. § 3509(d) (Federal Victims' Protection and Rights 
Act) 


On July 28, 2006, U.S. Magistrate Judge Armstrong signed a search warrant 
commanding search of YAHOO! INC. regarding URLs and email accounts: 

— (U)(3). ifi u.s.u s J3U9(U) uinu vitiuiMij aiiu uiiiiu wiLiiuyyuy iiLjinu.(tJHJ) li u st. 4 3jj.ji.ij.) {ryuyiai y iijtimy hi utuuuuri aiuj i 


ns 1 ' Pro tecti cfrf and I' ° n thl S 

search warrant via tacsimne to YAHOO! 
received via telephone call. 


date , SA I (b)(6) (b)(7)(C) | served said 
Confirmation from YAHOO! INC. was 


Bo th nm. j 1 ^ ™ j : ’■r™ 1 : ,u “ j 1 \ are 

advertising sites determined by agents located at C3 as sites which provide 


OFFICIAL USE ONLY 

THIS DOCUMENT IS LOANED TO YOU FOR OFFICIAL USE ONLY AND REMAINS THE PROPERTY 
OF THE DEPARTMENT OF HOMELAND SECURITY, ICE. ANY FURTHER REQUEST FOR 
DISCLOSURE OF THIS DOCUMENT OR INFORMATION CONTAINED HEREIN SHOULD BE REFERRED 
TO ICE HEADQUARTERS TOGETHER WITH A COPY OF THE DOCUMENT. 


Page 312 of 929 





OFFICIAL USE ONLY 



On August 8, 2006, the office of the RAC/BI received 
INC. via Federal Express. The response consisted 
contain the contents of intern et address URLs URL 


E 




J'f 37T5TTS "S'SCfST 

‘ ' ,r ' 


ights.(b)(3):18 U.s:c. S 3509(d) (Federal 


•tfiffw 


5 


response from YAHOO! 

? f i&?f»uggTa.‘ia! : L h gil£' m a i ld | to 

> l«itnpssps ! rinhts (h)(3)- IS I I R O S 3R()i>(ri) (Fpriprnl Vint 


as well as contents of email account 


SEARCH WARRANT 
GOOGLE INC. re 

HBjiJyiau.s.L. J 33 U 910 ) Lnim 
IrnitniMBi 1 rinhti (h)( 3 V IS 1 1 S P. 


#4 

yarding ^ email account: 


On July 28, 2006, U.S. Magistrate Judge Armstrong signed a search warrant 
c om m anding sea j~ch of G OOGLE INC. regarding email account: 

I H.g’Sm Kg 7,S,*, l On this same date, SR [ waa jj gSJ served said search 

warrant via facsimile to GOOGLE INC. Confirmation from GOOGLE INC. was 
received via email, a copy of which is maintained in the case file. 

SSA received a n email f rom I w^) wi^tc) fea mail . com following I (b)(7)(E) 

purchase to website on April 6, 2006. The message 

P r ° Vi1jiif i flu3PgjjBw j , p(j„„Bj|SsMq)r4.„jB |i tnr mation along with a link to the “MemberZone" 

URL (b)(3): 1 8 U.S C. § 3509(d) (Federal Victims' Protection and Rights I. 


On August 7, 2006, the office of the RAC/BI received a response from GOOGLE 
INC. via Federal Express mail. Material consisted o f one compact disk said to 

- ■ (b)(3): 1 S USC § 3509(d) Child victims and I .» 

rights (b)(3)- 18 U.5.C. § 350Sfdl ‘ 


contain the email contents of 


This investigation continues. 
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INTERIM RPT 



REPORT DATE 
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~ PROGRAM CODE 

REPORT NO. 

081006 

| 072606 
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RELATED CASE 
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COLLATERAL REQ : 


TYPE OF REPORT : 

SEARCH WARRANT REPORT / 

TOPIC: SEARCH WARRANT OBTAINED FOR WEBSITE | i s 8 ^ | (FedtmfvTclimr' d p C rote^ 


SYNOPSIS: 

On July 24, 2006, the Resident Agent in Charge, Birmingham, Alabama (RAC/BI) 
received a collateral request from the Immigration and Customs Enforcement, 
Cyber Crimes Center (C3) , regarding a lead from the National Center for 
Missing Information from NCMEC related to a 


wgbgite, 


reported &S offering child pornography,, 


Website, H! 


listed in the name of 


□ dir ected payments through 
of Fairfield, Alabama. 


a Paypal account. 


l 


On July 28, 2006, in the Northern District of Alabama, United States 
Magistrate Judge Robert R. Armstrong, Jr. signed four search warrants, 


commanding searches related to the investigation of 
fwn.l imisi: ‘ v . ■ ; •: • 1 1 .■ ■ ■ _ — I 


DISTRIBUTION: 


(b)(7)(E) | 

| (b)(6). (b)(7)(C) I SPECIAL AGENT 



ftP PROVED: 

| (b)(6). (b)(7)(C) | RAC -RESIDENT AGENT IN 

ORIGIN OFFICE: BI 
BIRMINGHAM, AL - RAC 

TELEPHONE: 205 73r“'7A“ A '' 1 

TYPIST: | (b)(6), (b)(7)(C) | 
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CASE NUMBER | (b)(7)(E) f 

REPORT NUMBER: 004 


DETAILS OF INVESTIGATION: 


On July 24, 2006, the Resident Agent in Charge, Birmingham, Alabama (RAC/BI) 
received a collateral request from the Immigration and Customs Enforcement, 
Cyber Crimes Center (C3) , regarding a lead from the National Center for 
Mi ssina and Evnloited Children (Nf-MF.Cl Tn format inn from NCMEC related f.n a 

(b)(3): 1 8 U.S.C. § 3509(d) Child victims 1 and child witnesses 1 rights, (b)(3): 18 U.S.C. § 3509(d) (Federal Victims' Protection and Rights Act), (b)(7)(E) 

websites offer access to members only ^lllolmHFederafvk 

Website, ^ I di r ec ted payments through a 

listed in the name of I (b)(6), (b)(7)(C) I o f Fairfield, Alabama. 


Paypal account , 


On July 28, 2006, in the Northern District of Alabama, United States 
Magistrate Judge Robert R. Armstrong, Jr. signed four search warrants, 
commanding searches related to the investiaation of 

I (E)(3): U.ij.L^abUaid^MrvTctJs 1 and cUd w.lnessesXghls I 3 

(h)(3) 1 fill fit S3!iHfi(finFFi(lFirnlViraimfi' Pmlpntinn mil Riiihla A r 


SEARCH WARRANT #1: 
SEAGATE 40Gb HARD DRIVE 


On May 25, 2006, Trial Attorney C 


‘>< 7 >< c > I . United States Department of 
Justice (DOJ) , Child Exploitation and Obscenity Section (CEOS), issued a 
preservation request pursuant to 18 U . S . C . JL7.Q3. i ,£ .} J&aL SENES IS 2 

NETWORKS preserve the contents of the URL 

pending issuance of a search warrant. In response to the preservation 
request, GENES IS 2 NETWOR KS provide d a Seagate 40Gb hard drive (Model 
ST340014A; Serial Number | (b)(7)(E) | ) , which is said to contain the contents of 

the aforementioned website. 


On July 21, 2006, U.S. DOJ/CEOS mailed said hard drive via Federal Express to 
the office of the RAC/BI, for the purpose of securing a search warrant for the 
contents of the drive. RAC/BI received the hard drive on July 24, 2006. 

On July 28, 2006, one of the four search warrants signed by U.S. Magistrate 
Judge Armstrong, was for the search of the above listed hard drive obtained 
from GENESIS2 NETWORKS, of Charlotte, North Carolina. 


On Au gust 2. 2006. custody of said hard drive was relinquished to ICE Special 
Agent ] (b)(6), (b)(7)(C) | of C3 , Child Ex ploitation Unit (CES) . Transfer of custody 

was evi denced by Customs Form 6051] (b)(7)(E) | and transferred in SEACATS 

(FP&F# : I W> 7 >i E > I ) . 

SEARCH WARRANT #2 

I iui(j). iuu.j.u g jjua|u)umu viuiiiii, anu umu wiuiutwdi, iiyiiit.iUAJj- iu | 
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GENES IS 2 NETWORKS 


2 ! 06 i a f e ; rc ? wa J r ; nt .- 

commanding search of URL j/b^vis use IssoQfdnFederai v^ms' Protean and RinhK aI located at web-hosting 
service location GENESIS 2 NETWORKS, 4200 Freedom Drive, North Carolina 28208. 


In April and June of 200 6. amnts of C3 oondnoted two ii ndprmvpr purchases to 
members only webs ite URL imms use I lloa/di (Fedt ranMms- d i^te^anrRiX a I (see ROI# 

| (b)(7)(E) | ) which offers an abundance of child pornography. C3 agents 

retrieved 969 images from the website, of which, members of NCMEC, were able 
to identify 171 image files depicting victims previously identified by law 
enforcement investicrations . On Julv 24. 2006. aaents of the RAC/BI also 


(b)(7)(E) 


On July 31, 2006, the office of the RAC/BI coordinated with the RAC, 

Charlotte, North Carolina (CR) to effect the search located at GENESIS2 
NETWORKS, 4200 Freedom Drive, North Carolina 28208. The original . search 
warrant was mailed to RAC/CR on this same date, via DHL. 

On August 3, "2006, agents of the RAC/CR advised that service of the search 
warrant was executed on this date. Agents seized one hard drive from GENESIS2 
NETWORKS, which will be examined by C3 for contents relating to child 
pornography as defined by as defined in 18 U.S.C. 2256. RAC/CR has forwarded 
the hard drive to agents at C3, and returned the original search warrant to 
the office of the RAC/BI. 


SEARCH WARRANT #3 

YAH OO! INC, regarding the fol lowing URLs and email accounts 

URL I (b)(3): 1 8 U. S. C. § 3509(d) Child victims' and child 
rlriT witnesses' rights,(b>(3>: 1 8 U.S.C. § 3509(d) (Federal 
URL Victims' Protection and Rights Act) 


On July 28, 2006, U.S. Magistrate Judge Armstrong signed a search warrant 

i IN ^ PI m 11 accounts -- 

■ U S P S if ndnr.l Vi r URL | child wUnesses rights (b)(3) 1 8 II S C 1)351)9(111 1/ 

I (b)(3): IB U.S.C. $ 30Ua(d) Child victims ana child witnesses n f-y.4 p r 3 = t"P QA I (b)(6).(b)(7)(C) I qprvprt 1 d 

I rinhts (hO in uses asnSfriHFfirifirnl Vitfims' Prntp.rtim nnrt un cnis same aace , bA | ^ « I servea ^aia 

search warrant via facsimile to YAHOO! INC. Confirmation from YAHOO! INC. was 
received via telephone call. 

not I (b)CT IH U.S.U. !) Sbuy(d) Child victims' and child 1 , ITOT I (UJUJ 14 U J U .5 JJUil(U) Ulllll UIOUIMU HIIU I 

BOtn URL| w j| nf!a!iis ' rinhtfl lii)(31 Ifi U SCI S 351)3(11) (Ffiflfiffll Vir.l > anQ UKij •I fh 'l ri utn a n a t nnhu fhV3l IS I I s r fi Tinsfrl l^ <*1^ 

advertising sites determined by agents located at C3 as sites which provide 


OFFICIAL USE ONLY 

THIS DOCUMENT IS LOANED TO YOU FOR OFFICIAL USE ONLY AND REMAINS THE PROPERTY 
OF THE DEPARTMENT OF HOMELAND SECURITY, ICE. ANY FURTHER REQUEST FOR 
DISCLOSURE OF THIS DOCUMENT OR INFORMATION CONTAINED HEREIN SHOULD BE REFERRED 
TO ICE HEADQUARTERS TOGETHER WITH A COPY OF THE DOCUMENT. 


Page 317 of 929 





OFFICIAL USE ONLY 


DEPARTMENT OF 

HOMELAND SECURITY 
ICE 

PAGE S 
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CONTI 

N U A T I O N 
■ ■■ - - - 1 — (bW3V18 U.S.C S' 3305(d) Child w 

REPORT NUMBER : 

dims ana child witnesses’ 1 =~ 

004 j 


W mei 110610 KJllXy Site UKU fronts fb>13> 18 use 6 3509(d) (Federal Victims' Protection and Rl ■ WWIIUIWLIOII U 

these advertising sites prior to agents making undercover purchases revealed 
that the site offered a "FREE PREVIEW" hyperlink containing approximately 2 5 
images de picting prepubescent female minors engaged in sexually explicit 
conduct . ' 




(b)(7)(E) 


J. an ema il was issued to the UC agent from email address 


rights, (b)(3): 1 8 U.S C. S 3509(d) (Fed " 


On August 8, 2006, the office of the RAC/BI received a response from YAHOO! 
INC. via Federal Express. The response consisted o f jmg q g gmgj|C t ^ sc to 

co S t ,^f I A t vicb 1 fe5S r P et add ^ ss URLS „ , iqh ,,r B , i 3, ,s u S c'^3S^,Tf.^,iv,| - 

and «««,., I. as well as contents of email account 

i child witnesses ri^ 


1(b)(3): 18 U.S.C. $ 3509(d) Child 


SEARCH WARRANT #4 

GOOGLE INC. regarding email account: 

I (bH3P?U.y.(J. fAuStf) Ufiild victims 7 and child I 

IwitnBssBS' riahta. (b)(3); 1 a U.S.C. S 35fl8(d) (Fads) 


On July 28, 2006, U.S. Magistrate Judge Armstrong signed a search warrant 
commanding search of G OOGLE INC. regarding em ail accoun t: 
BSSESfeESBSI- 0n this same date SAl«™pr served said search 
warrant via facsimile to GOOGLE INC. Confirmation from GOOGLE INC. was 
received via email, a copy of which is maintained in the case file. 

SSA 


ii\ir\ j received a n email from bormanorama@g mail . com following [_ 
(b)(7)(E) | to website l 


. ] on April 6, 2006. The message 

pro videef login, and password info rmation along with a link to the "MemberZone" 

rin T I (b)(3): 18 U.S.C. § 3509(d) Child victims' and child witnesses 1 rights, I 

u *' Jj 1(b)(3): 18 U.S.C. S 3509(d) (Federal Victims’ Protection and Rights a| * 0 

On August 7, 2006, the office of the RAC/BI received a response from GOOGLE 
INC. via Federal Express mail. Material consisted of one compact disk said to 

4.1 1 (b)(3) I MUSL Child victims and chi l d I 

contain the email contento of | amnaaaaa aabta. (h)(3) ifi 1 1 .S L f, 35 nadti (Fpri I- 
This investigation continues. 
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On July 28, 2006, in the Northern District of Alabama, United States 
Magistrate Judge Robert R. Armstrong, Jr. signed four search warrants, 
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DETAILS OF INVESTIGATION: 


On July 24, 2006, the Resident Agent in Charge, Birmingham, Alabama (RAC/BI) 
received a collateral request from the Immigration and Customs Enforcement, 
Cyber Crimes Center (C3) , regarding a lead from the National Center for 
Missing and Exploited Children (N CMEC) . Information from NCMEC related to a 
website. I . reported as offering child pornography. 


(b)(3): 1 8 U.S.C. § 3509(d) Child victims' and child witnesses' rights, (b)(3): 18 U.S C § 3509(d) (Federal Victims' Protection and Rights Act), (b)(6), (b)(7)(C), (b)(7)(E) 


On July 28, 2006, in the Northern District of Alabama, United States 
Magistrate Judge Robert R. Armstrong, Jr. signed four search warrants 
commanding searches related to the investiaation of 

I (b)(3)! 18 U.ti.U. ^ 3bUl(d) Child WArW ihd fchiltf WithBM6S' rights, I 3 

1(h)(3) 1 fi 11 S P. 6 ftfilfflfri) (FRilRrnl Vintima' PrntRttinn nnri Rinhla ftr 


SEARCH WARRANT #1: 
SEAGATE 40Gb HARD DRIVE 


On May 25, 2006, Trial Attorney | (b)(G> (b)(7)(C) | , United States Department of 

Justice (DOJ) , Child Exploitation and Obscenity Section (CEOS) , issued a 
g”S“E tion re «“ e “ pursuant ^ U.^c W SIS2 

NETWORKS preserve the contents o£ the URL k,,, m mm imt m »l 
pending issuance of a search warrant. In response to the preservation 
request, GENESIS2 NETWOR KS provide d a Seagate 40Gb hard drive (Model 
ST340014A; Serial Number I < b >( G > (b)(7)(C)] t which is said to contain the contents of 
the aforementioned website. 


On July 21, 2006, U.S. DOJ/CEOS mailed said hard drive via Federal Express to 
the office of the RAC/BI, for the purpose of securing a search warrant for the 
contents of the drive. RAC/BI received the hard drive on July 24, 2006. 

On July 28, 2006, one of the four search warrants signed by U.S. Magistrate 
Judge Armstrong, was for the search of the above listed hard drive obtained 
from GENESIS2 NETWORKS, of Charlotte, North Carolina. 

On Au gust 2, 2006, custody of said hard drive was relinquished to ICE Special 
Agent f~ (b)(6), (b)(7)(c) | of C3, Child Ex ploitation Unit (CES) . Transfer of custody 
was evidenced by Customs Form 6051 I (b)(7)(E) I, and transferred in SEACATS 
(FP&F#: . 


SEA 

URL 


ses rights I 
Td^jghtsAj 
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CASE NUMBER | (b)(7)(E) | 

REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: 005 


IP Address; I (b>(s>,(b>(7>(c> T 
GENES IS2 NETWORKS 


On July 28, 2006, U.S. M agistrate ^ Judge Arms trong sign ed a search warrant 
commanding search of URL jnnhtil »?v3v mu s r. ^nn^nri p! located at web-hosting 
service location GENESIS2 NETWORKS, 4200 Freedom Drive, North Carolina 28208. 


(b)(3): 1 8 U.S.C. § 3509(d) Child victims' and child witnesses' rights, (b)(3): 18 U.S.C. § 3509(d) (Federal Victims' Protection and Rights Act), (b)(7)(E) 


On July 31, 2006, the office of the RAC/BI coordinated with the RAC, 

Charlotte, North Carolina (CR) to effect the search located at GENESIS2 
NETWORKS, 4200 Freedom Drive, North Carolina 28208. The original search 
warrant was mailed to RAC/CR on this same date, via DHL. 

On August 3, 2006, agents of the RAC/CR advised that service of the search 
warrant was executed on this date. Agents seized one hard drive from GENESIS2 
NETWORKS, which will be examined by C3 for contents relating to child 
pornography as defined by as defined in 18 U.S.C. 2256, RAC/CR has forwarded 
the hard drive to agents at C3, and returned the original search warrant to 
the office of the RAC/BI. 


SEARCH WARRANT #3 

YAHOO! INC, regarding the fol lowing URLs and email accounts: 

(b)(3): 18 U.S.C. § 3509(d) Child victims' a 
rights, (b)(3): 1 8 U.S.C. § 3509(d) (Federal Vi 
Rights Act) 


tims' Protection and I 


On July 28, 2006, U.S. Magistrate Judge Armstrong signed a search warrant 
commandina search of YAHOO! INC. regarding URLs and email accounts 

| WllHo ittr, "y^D'i'ri 11 if ‘t-h — t — — 


(b)(3): 18 U.S L* ^ JbUy(d) (Federal Victims' Protection and 

I On this same date. SA I (b)(6), (b)(7)(c) | served said 
search warrant via facsimile to YAHOO! INC. Confirmation from YAHOO! INC. 
received via telephone call. 

Both urlE™ 


> 


advertising sites determined by agents located at C3 as sites which provide 
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CASE NUMBER | 

(b)(7)(E) | j 

REPORT OF I 

NVESTIGATION 



CONTI 

N U A T I O N 

r- 1(b)(3): 1 « U Si t K 3bU(J(d) Child victim; 

REPORT NUMBER : 

s- and child -witnesses- rights. |— — 

005 


A 'ISnQtHi rForiaral Vii-timc' Prntcrtinn ar 


these advertising sites prior to agents L 
that the site offered a "FREE PREVIEW" hyperlink containing approximately 25 
images de picting prepubescent female minors engaged in sexually explicit 
condu 




f r ' um. nrcrs. 

I riahts.(b»3V18 U.S.C. S 35Q9fd) (Federal Victims' Protection and 


I, an ema il was issued to|~ 


] from email address 


On August 8, 2006, the office of the RAC/BI received a response from YAHOO! 
INC. via Federal Express. The response consisted of one rnmnarf disc — sajd, to 
contain address URLs URL:[ witnesses riqhtsib)l3V18 U.S.C. S 350 

. a R& aS Wel1 aS ContentS of emaii account 


SEARCH WARRANT #4 

GOOGLE INC. regarding email account: 

1(b)(3)! 18 u.s.u. & Jbuyjd) uhiia mm' am dMtfi 
IwitnRflflRfl rinhtathO IR Iiar. 6 Mil) (F riIrI 

On July 28, 2006, U.S. Magistrate Judge Armstrong signed a search warrant 
INC. regarding email account: 

I shiid 'ffltnessea 1 riahtsibHai! is (Ts.cl' s • On this same date, SA | (b)(6),(b)(7) ( c)J served said search 
warrant via facsimile to GOOGLE INC. Confirmation from GOOGLE INC. was 
received via email, a copy of which is maintained in the case file. 


(b)(3): 1 8 U.S.C. § 3509(d) Child victims' and child witnesses' rights, (b)(3): 18 U.S.C. § 3509(d) (Federal Victims' Protection and Rights Act), (b)(7)(E) 


On August 7, 2006, the office of the RAC/BI received a response from GOOGLE 
INC. via Federal Express mail . M a ter i a.1 ^ ^co n s_i s t e d o f one compact disk said to 

ill! witnRSSRS nnhts IhO In LJ S P. 5 I • 


contain the email contents of 


This investigation continues. 
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RELATED CASE NUMBERS: 
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SEARCH WARRANT REPORT / 



TOPIC; SEARCH WARRANT OBTAINED FOR EMAIL ACCOUNT AT GOOGLE INC. 


SYNOPSIS: 

On July 24, 2006, the Resident Agent in Charge, Birmingham, Alabama (RAC/BI) 
received a collateral request from the Immigration and Customs Enforcement, 
Cyber Crimes Center (C3) , regarding a lead from the National Center for 

Missing ^d-EaiPloitfid-Childrexi— tflOlECL. Iaf.QmaLip.n-£xoiQ-.N.CIlEC-Ls..la.,Lg.d-tr.g_.a, 

website 
Agents ; 
with an 


(b)(3): 18 U.S.C. § 3509(d) Child victims' oi 


Id witnesses' rights, (b)(3): 18 U.S.C. § 3509(d) (Federal Victims' Protection at 
“I (b)(3): 1? 


I Rights Act), (b)(7)(E) 


websites of fer access to members only website Prg^^gnyn^P'a^ P 
Website, I J nnh^hvg^ri^ r'7^ ^“7^. I dir ected payments through a Paypal account 
listed in the name of | (b«B> waxo | of Fairfield, Alabama. 

On July 28, 2006, in the Northern District of Alabama, United States 
Magistrate Judge Robert R. Armstrong, Jr. signed four search warrants, 
commanding searches related to the investiqation of 

1 (b)(3): I !! U.K.U. t) 3bU!/(d) Chi l d Victims ' and child witnesses ' rights. I 
I (him?) 11 fit 6 .IliliMI fFp.ijp.ml Vitfims' PrnlRflinn and Rmhta I ■ 


[■■iiiiiiBaiiMg 



1 IO U O l, 9 OJU3|U| I.I1IIJ VlUllllb Ol'U U"IU I qpFCTAT. AGFNT 
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CASE NUMBER | (b)(7)(E) | 

REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: 006 


DETAILS OF INVESTIGATION: 


On July 24, 2006, the Resident Agent in Charge, Birmingham, Alabama (RAC/BI) 
received a collateral request from the Immigration and Customs Enforcement, 
Cyber Crimes Center (C3) , regarding a lead from the National Center for 
Missina and ExDloited Children (NCMEC) . Information from NCMEC related to a 

, . . I — (bVSViyUB.C. K SbUH/dl Child victims and child I . , ^ , 

t-P* I ' ."...I ronnrl-cH acs ^fforinn r»Vvi 1 d r-'O-rnorTr-ay-Vh v 


(b)(3): 18 U.S.C. § 3509(d) Child 


Id witnesses' rights, (b)(3): 18 U.S.C. § 3509(d) (Federal Victims' Protection and Rights Act), (b)(7)(E) 


websltes otter access., to iiiembera o nly website 

/ I witn e ss e s' rjphts mmv 18 1 1 f r fi Tinf i l i ll (F a rt a rn l V i m I dl . r ected p _ 

J of Fairfield 


IU U.J.U. y jjui ( u; umu uiLuuit anu umu wiumsbus iigiut, | 

. (b)(3): 18 U.S C, $ 3509(d) (Fgdgral Victims' Protean anfl R.ightg |- 

greeted payments through a Paypal account, 
Alabama . 


Website, 
listed in the name of [" 


On July 28, 2006, in the Northern District of Alabama, United States 
Magistrate Judge Robert R. Armstrong, Jr. signed four search warrants, 
| l gjg i mWad)ghmSi 1 g^hSf, j: gA i; |h,, t | 0 the investigation o£ 

I tbO;18 V.SiCi S 35Qg(tl> (Federal Yiflims' Preteaien anti Riahs I • 


SEARCH WARRANT #1: 
SEAGATE 40Gb HARD DRIVE 


On May 25, 2006, Trial Attorney | (b>(6> (b)(7)(C) | , United States Department of 

Justice (DOJ) , Child Exploitation and Obscenity Section (CEOS) , issued a 
preservation request pursuant to 18 U.S.C. 2703(f), requesting that GENESIS2 
NETWORKS preserve the contents of the URL te»,V,V 

pending issuance of a search warrant. In response to the preservation 
request, GENESIS2 NETWOR KS provide d a Seagate 40Gb hard drive (Model 
ST340014A; Serial Number | (b)(6> (b)(7)(cT~b , which is said to contain the contents of 
the aforementioned website. 


On July 21, 2006, U.S. DOJ/CEOS mailed said hard drive via Federal Express to 
the office of the RAC/BI, for the purpose of securing a search warrant for the 
contents of the drive. RAC/BI received the hard drive on July 24, 2006. 

On July 28, 2006, one of the four search warrants signed by U.S. Magistrate 
Judge Armstrong, was for the search of the above listed hard drive obtained 
from GENESIS2 NETWORKS, of Charlotte, North Carolina. 


On August 2, 2006, custody of said hard drive was relinquished to ICE Special 
Agent Matthew Dunn of C3, Child Ex ploitatio n Unit (CES) . Transfer of custody 
was evi denced by Customs Form sort l~ (b)(7)(E) I, and transferred in SEACATS 
(FP&F# : | (b)(7)(E) ~~| ) - 


S EAR£H_ MRRM2_&2_ 
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IP Address: 


(b)(6), (b)(7)(C) 


GENES IS2 NETWORKS 


On July 28, 2006, U.S. Ma gistrate Judge Armstrong sig ned a search-warrant 
commanding search of URL i ^ located at web-hosting 
service location GENESIS2 NETWORKS, 4200 Freedom Drive, North Carolina 28208. 


In April and June of 2006, agents of C3 conducted two undercover purchases to 
r^pmhpvr. nn i v WP hHt- P nRT IdSM'ISUbL t, JSUUldJ UUffiMMU AUOUaWHUlU ftflhB, | , ,, 

mempers only weosice ukli ihwnaiisi; s P,n. C r.„n u,nh lt I (see ku±f 

I (b)(7)(E) | ) which offers an abundance of child pornography. C3 agents 

retrieved 969 images from the website, of which, members of NCMEC, were able 
to identify 171 image files depicting victims previously identified by law 
enforcement investigations. On July 24 . 2006. agents of the RAC/BI also 

(b)(7)(E) 


On July 31, 2006, the office of the RAC/BI coordinated with the RAC, 

Charlotte, North Carolina (CR) to effect the search located at GENESIS2 
NETWORKS, 4200 Freedom Drive, North Carolina 28208. The original search 
warrant was mailed to RAC/CR on this same date, via DHL, 

On August 3, 2006, agents of the RAC/CR advised that service of the search 
warrant was executed on this date. Agents seized one hard drive from GENESIS2 
NETWORKS, which will be examined by C3 for contents relating to child 
pornography as defined by as defined in 18 U.S.C. 2256. RAC/CR has forwarded 
the hard drive to agents at C3 , and returned the original search warrant to 
the office of the RAC/BI. 


SEARCH WARRANT #3 

YAH OO 1 INC, regarding the fo llowing URLs and email accounts: 

T-j-p r I (b)(3): 18 U.S.C. § 3509(d) Child victims- and child I 


witnesses' rights, (b)(3): 1 8 U. S. C. § 3509(d) (Federi 

r TO )!ii u a j yf g 


I rights, (b)(3), IS U.S.C. S 35Qg(d) (Federal Victims' Pratectian and I 


On July 28, 2006, U.S. Magistrate Judge Armstrong signed a search warrant 
commanding search of YAHOO! INC. regarding URLs and email accounts: 

i(j): iru.s.u 4 jsuy(a) tnna victims aha cnna witnesses rights, ( bxj): w u.s.u 4 si 


URL r" 


, J5U9(0) t 


§ jsuy(a) (t-sasrsi victims 1 


^"" rfl,l On A this same date, 5a I (b)(6), (b)(7)(c) | served said 


(B)(j)!'ia u.s.u 4 jsuyifl) cnna victim; 

I rinhfi (h)(3)- 1 R 1 1 S n R Sfinaf tl) (Fpriprnl Virtims' Prntprtinn ni _ _ „ 

search warrant via facsimile to YAHOO! INC. Confirmation from YAHOO! INC. was 
received via telephone call. 


Wl-5) li 


„ I) JJUiUl!) L 


3 are 


advertising sites determined by agents located at C3 as sites which provide 
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CASE NUMBER | (b)(7)(B) f 

REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: 006 


access to members only site” URL ^ 


ww w -‘--7 1 R 1 1 s r k -wnotrtt \r, 

these advertising sites prior to agents |_ 


Examination of 


] revealed 


that the site offered a “FREE PREVIEW" hyperlink containing approximately 25 
images depicting prepubescent female minors engaged in sexually explicit 
conduct. After C3 agents initiated an undercover purchase to members only 
site http ; / /members . ho mecollect . us . through a dvertising sit e 
I. an ema il was issued t 

(b)(3): 18 U.S.C. § 3509(d) Child victims' and child witnesses' 1 
rights. 1bH3): 18 U.S.C. S 3509(d) (Federal Victims' Protection and ! • 


from email address 


On August 8, 2006, the office of the RAC/BI received 
INC. via Federal Express. The response consisted 
contain the contents of intern et address URLs URL latnaaaaa nnbta 

•• “ con t ent s ^rSStnSSSr“ 


response from YAHOO! 

r sswasMte ■ g? ld to 

J V.viinfin.ia.i nnliifiimm In llfir. 6 351)9(1; 


SEARCH WARRANT #4 

.GOOGLE INC, regarding, email account : 

[witnesses' rights.(bH3): 18 U.S.C. 8 3509(d) (Fedel 

On July 28, 2006, U.S. Magistrate Judge Armstrong signed a search warrant 
af , G00GLE ™ C - regarding em ail accou nt: 

IrhiiH rin&Jh°nv^ 1 1 * p r irhomi I . On this same date, SA | (b)(6), (b)(7)(C) | served said search 
warrant via facsimile to GOOGLE INC. Confirmation from GOOGLE INC. was 
received via email, a copy of which is maintained in the case file. 


(b)(3): 1 8 U.S.C. § 3509(d) Child victims' and child witnesses' rights, (b)(3): 1 8 U.S.C. § 3509(d) (Federal Victims' Protection and Rights Act) 


On August 7, 2006, the office of the RAC/BI received a response from GOOGLE 
INC. via Federal Express mail . Material consisted of one compact disk said to 
contain the email contents of SSB SSSSal ■ 


This investigation continues. 
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SEARCH WARRANT REPORT // COLLATERAL 

REQUEST / IN 


TOPIC: SEARCH WARRANT FOR AT APOLLO HOSTING 


SYNOPSIS : 

On July 24, 2006, the Resident Agent in Charge, Birmingham, Alabama (RAC/BI) 
received a collateral request from the Immigration and Customs Enforcement, 
Cyber Crimes Center (C3) , regarding a lead from the National Center for 
Missing an d ^ i ldrej^J NC MEC ) . Information from NCMEC related to a 

website. Ltnel?J ■ . ; ^Federal vl . rp.nnrt~.firi as of.f.er.i.ua.-r.h.i.l.ri noimoaxanhy.., 


(b)(3): 18 U.S.C. § 3509(d) Child victims' and child witnesses' rights, (b)(3): 18 U S.C. § 3509(d) (Federal Victims' Protection and Rights Act), (b)(6), (b)(7)(C), (b)(7)(E) 


On September 11, 2006, in the Northern District of Alabama, Chief United 
States Magistrate Judge Paul W. Greene s igned four search warrants, com manding 
searches related to the investigation of 




(b)(7)(E) 

| | SPECIAL AGENT 

APPROVED: , 

| (b)(6), (b)(7)(C) | RAC- RESIDENT AGENT IN 


ORIGIN OFFICE: BI 
BIRMINGHAM, AL - RAC 

TELEPHONE : 205 73| 1 

TYPIST:! (b)(3), (b)(7)(C) | 
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REPORT OF INVESTIGATION 
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DETAILS OF INVESTIGATION: 


On July 24, 2006, the Resident Agent in Charge, Birmingham, Alabama (RAC/BI) 
received a collateral request from the Immigration and Customs Enforcement, 
Cyber Crimes Center (C3) , regarding a lead from the National Center for 
Missing and Exploited Children (NC MEC) . Information from NCMEC related to a 

t-A I (b>(3):18 U SC S_35U!j(d)_Child victims and child | y^riAr-r n g f ^ v i nn r-hilrl nnrnnrtrjnhv 


(b)(3): 1 8 U.S.C. § 3509(d) Child victims' and child witnesses' rights, (b)(3): 18 U.S.C. § 3509(d) (Federal Victims' Protection and Rights Act), (b)(8), (b)(7)(C), (b)(7)(E) 


On September 11, 2006, in the Northern District of Alabama, Chief United 
States Magistrate Judae Paul W. Greene sianed four search warrants, commandinq 
searches related to the investioation of I 18 u 8 c 5 ^.ld vTct'ms and ch.ld witness el ngKts, I 

searcnes reiatea to tne investigation or u iSiCi $ 35 a g lfll (Federal Victims' Prctecticn and Rights A r 



Located at Juno Online Services 

On September 11, 2006, Chief Magistrate Judge P aul W. Greene signed a search 
warrant commanding the search of e-mail located 

at Juno Online Services of New York, NY. I child witnesses riohtsTbihv is uses 35091 1 is one of two 
email accounts associated with the Paypal account utilized ^ to fa cilitate 
payments from customers to website SSI I ■ a website 

confirmed t o conta in child pornographic images. The Paypal account being 
utilized by I to facilitate payments, also lists an additional e-mail 

address at Charter Communications, the subject of SEARCH WARRANT #2. 

On September 11, 2006, SEARCH WARRANT #1 was served to Juno Online Services 
via facsimile. 

.SEARCH W ARR ANT it 2 

| (b)(8), (b)(7)(C) | 

Located at Charter Communications 

On September 11, 2006, Chief Magistrate Judge P aul W. Greene signed a s earch 

warrant commanding the search of e-mail account 1 _ i b )( E ).M( 7 X c ) I . 

located at Charter Communications in St. Louis, MO. | ( b >< 6 >, (b)(7)(c) | 

is one of two email accounts associated with the Paypal account ut i 1 ized to 
facilitate payments from customers to website I I * a 

website confirmed to cont ain child pornographic images. The Paypal account 
being utilized by I W 1 7 r .\ u ” ,) I to facilitate payments, also lists an additional 
e-mail address at Juno Online Services, the subject of SEARCH WARRANT ttl. 
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(b)(3): 18 U.S.C. § 3509(d) Child victims' and child witnesses' rights, (b)(3): 18 U.S.C. § 3509(d) (Federal Victims' Protection and Rights Act), (b)(7)(E) 


On September 11, 2006, SEARCH WARRANT #3 was served via facsimile YAHOO! INC. 


SEARCH WARRANT U 

(b)(3): 1 8 U.S.C. § 3509(d) Child victims' and child witnesses' rights, 
(b)(3): 18 U.S.C. § 3509(d) (Federal Victims' Protection and Rights 
Act), (b)(6), (b)(7)(C) 

Located at Apollo Hosting, Inc . 


On September 11, 2006, Chief United States M ag is t r a t e Judge Paul W , Greene 
signed a search warrant commanding search of I « n w.13 1 ' d.'Z^L71 . 

located at Apollo Hosting, Inc., 2303 RR620 South, Suite 135-301, Austin, 
Texas 78734 . 


Website [ 


(bpy i iiusi: s abused) chi l d wctim 
(b)(3). IS U.S.C. 5 35Q31d) (Federal Victims' 


S°iS"a"nViSiiS1 has been determined by agents at C3 to 


contain lewd and lascivious images of child pornography. As of this date, C3 
agents hav e identified over 171 image s th at contain previously identified 
c Vi 1_ l_di~©n | ' u a j i- 10 uo1 - s ojuow t-niiu vicums arm cnim witnesses ngius i accessed bv a number of 

uiiiuien. I fhO m il . sc R . i . inf i iriwFpiipr . i i V i min-v Prntpmnn fflriP i pjiv-! (I { V j 5 U y a Y I nnav i H i mt I anaem i a i ^ L 

advertising sites, recently found isii^r nmciMWF^I is one such 

advertising site and is the subject of SEARCH WARRANT #3. 


COLLATERAL REQUEST TO RAC AUSTIN, TEXAS (RAC/AU) 


It is respectfully requested that agents of the RAC/AU serve SEARCH WARRANT #4 
as described in the above paragraph to Apollo Hosting, Inc. at 2303 RR620 
South, Suite 135-301, Austin, Texas 78734. Please forward all items received 
from the s earch to include hard drives, compact discs etc., to Special Agent 
| (b)(6), (b)(7)(c) | of C3 . Please remit the return of the search warrant to RAC/BI 
Special Agent I (bxenb^xo | . along with copies of any hard copy paperwork 
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located during the search as well as copies of 6051 's and 151 's. 
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PAGE 
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CASE 
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CASE STATUS: 


INTERIM RPT 


DATE ASSIGNED 
072606 

PRO< 

iHi 





REPORT DATE 
091106 


RELATED CASE NUMBERS: 


REPORT NO. 
010 


COLLATERAL REQ: 


TYPE OF REPORT: 

SEARCH WARRANT REPORT / 


TOPIC: SEARCH WARRANT OF WEBSITE ADDRESS u.j^^SS'cg^^ilrai 


SYNOPSIS : 

On July 24, 2006, the Resident Agent in Charge, Birmingham, Alabama (RAC/BI) 
received a collateral request from the Immigration and Customs Enforcement, 
Cyber Crimes Center (C3) , regarding a lead from the National Center for 
Missing and Exp^oi fcgd iiiu ( N CMEC ) . Information from NCMEC related to a 

.website. V.,'u\r. 'ir/'i V s :V rl iiir.'rip'rniwl. reported as of£flEinq..chiId-mrnoqraphY. 


(b)(3): 18 U.S.C. § 3509(d) Child victims' si 


Id witnesses’ rights, (b)(3): 18 U.S.C. § 3509(d) (Federal Victims' Protection and Rights Act), (b)(6), (b)(7)(C), (b)(7)(E) 


On September 11, 2006, in the Northern District of Alabama, Chief United 
States Magistrate Judge Paul W. Greene s igned four search warrants, co mmanding 
searches related to the investigation of ■ 


, DISTRIBUTION; 

SIGNATURE: 

(b)(7)(E) | 

| (b)(6), (b)(7)(C) | SPECIAL AGENT 



APPROVED : 

| (b)(6), (b)(7)(C) | RAC- RESIDENT AGENT IN 

ORIGIN OFFICE: BI 
BIRMINGHAM, AL - RAC 

TELEPHONE: 205 7^ | 

TYPIST: | (b)(6), (b)(7)(C) 1 
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DETAILS OF INVESTIGATION: 


On July 24, 2006, the Resident Agent in Charge, Birmingham, Alabama (RAC/BI) 
received a collateral request from the Immigration and Customs Enforcement, 
Cyber Crimes Center (C3) , regarding a lead from the National Center for 
Missing and Exploited Children {NCMEC) . Information from NCMEC related to a 
website, http://wirefreecandy.com, reported as offering child pornography. 
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CASE NUMBER | (b)(7)(E) | 

REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: 010 


On September 11, 2006, SEARCH WARRANT #2 was served to Charter Communications 
via facsimile. 

^witnesses' rights. fblf 31:1 8 U.S.C S 3509fdHFederl 

Located at YAHOO! INC. 

On September 11, 2006, Chief U.S. Magistrat e Judge Paul W. Greene signed a 
search warrant commanding sear ch o| located at 
YAHOO! INC. of Sunnyvale, CA. UmeaaMria^ is an advertising site 

determine d ^ h | ^c[^n^ lQ^^ed d |t^.g e ^, 3 ,S h , ai tea which provide access to members 
only site |, m m up an saanaiaiiFRMMBimjprntMmmaRiarrAl- Examination of this site pnpr to 

(b)(3): 1 8 U.S.C. § 3509(d) Child victims 1 and child witnesses' rights, (b)(3): 18 U.S.C. § 3509(d) (Federal Victims' Protection and Rights Act), (b)(7)(E) 


On September 11, 2006, SEARCH WARRANT #3 was served via facsimile YAHOO! INC. 
SEARCH WARRANT #4 

GQQ.QtE INC, regarding email., account : 


Act), (b)(6), (b)(7)(C) , 

Located at Apollo Hosting, Inc 


On September 11, 2006, Chief United States Magistrate Judge Paul 

a Ma rrh ..rr.nt ™n^nrt ccrnh n f |» > W Uhld vd.ms; and ch 


located at Apollo Hosting, 
Texas 78734. 


Inc., 2303 RR620 Sou' 


.is li&c. aaaiati 

th, Suit' 


e 135-301, Austin, 


contain lude and lascivious images of child pornography. As of this date, 
agents have identified over 171 images that contain previously identified 


advertising sites, recently found 
advertising site and is the subject of SEARCH WARRANT #3 

This investigation continues. 
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ICE 


REPO R T OF INVESTIGATION 


TECS ACCESS CODE IT 


CASE NUMBER 


I TITLE: COMMERICAL CP WEBSITE KNOWN AS nnT ,1 






CASE STATUS: 

INTERIM RPT 



REPORT DATE 
091806 

DATE ASSIGNED 
072606 

PROGRAM CODE i 

j ^7: j 

REPORT NO. 
011 


RELATED CASE NUMBERS: 


COLLATERAL REQ: 


TYPE OF REPORT: 
OTHER INFORMATION 


/ SEARCH WARRANT REPORT / 


TOPIC: RESPONSE FROM YAHOO! INC. FROM SEPTEMBER 11, 2006 SEARCH WARRANT 


On July 24, 2006, the Resident Agent in Charge, Birmingham, Alabama (RAC/BI) 
received a collateral request from the Immigration and Customs Enforcement, 
Cyber Crimes Center {C3) , regarding a lead from the National Center for 
Missing XMalt? Bt ifa ( >p EC ■ > • Information from NCMEC related to a 

wtwlte. reported as offering child pornography. 


(b)(3): 18 U.S.C. § 3509(d) Child victims’ and child witnesses’ rights, (b)(3): 18 U.S.C. § 3509(d) (Federal Victims' Protection and Rights Act), (b)(7)(E) 


On September 18, 2006, the office of the Resident Agent in Charge received one 
compact disc from YAHOO! INC. i n response to a search warrant issued to the 
company for contents of website ^77 7T 7^^77,71 ■ 




(b)(7)(E) | 

| (b)(6), (b)(7)(C) | SPECIAL AGENT 



1 tb)^): 1 is u.s.c $ 3suy(d) Child Victims and child i R AC-RRSTnRNT AORNT TN 

1 witnesses’ nnhts thtfaVIS 1 1 S C S 3SH9M1 federal 1 KiiiJ J.1 JUN .1 AtjiilN 1 

ORIGIN OFFICE: BI 
BIRMINGHAM, AL - RAC 

TELEPHONE: 205 73| w 7^"''l 

TYPIST: | (b)(6), (b)(7)(C) f 
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CASE NUMBER | (b)(7)(E) | 

REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: Oil 


DETAILS OF INVESTIGATION: 


On July 24, 2006, the Resident Agent in Charge, Birmingham, Alabama (RAC/BI) 
received a collateral request from the Immigration and Customs Enforcement, 
Cyber Crimes Center <C3) , regarding a lead from the National Center for 
Missing and Exploited Children^ NC MEC) . Information from NCMEC related to a 
website, reported as offering child pornography. 


(b)(3): 1 8 U.S.C. § 3509(d) Child victims' and child witnesses' rights, (b)(3): 18 U.S.C § 3509(d) (Federal Victims' Protection and Rights Act), (b)(8), (b)(7)(C), (b)(7)(E) 


On September 18, 2006, the office of the Resident Agent in Charge received one 
compact disc from YAHOO! INC. i n response to a search warrant issued to the 
company for contents of website TSuptlerl - and an Y related email 

address. The search warrant was! i ssued on seuteiiiuejr rri, 2006 and served via 

^]) . The contents of the 


The search __ 

facsimile that same day (ref. ROI# [ 


U'." l V:v i V'. l . l :i l " "■ — ■■ - V 1 

states that the website 


„to two emails for related email account 

v a, .letter from YAHOO! Inc 


: -Mnesggg pahft.tMi 


deactivated on August 13, 2006 

I 1 if f l/lbljy(d) Child victims 1 and child witnesses 1 rights, I 
1(h)(3) Ifl USDS 3h()fl(ri) (Ffiriurnl Victims' Prntpflinn nnri Rmhta A I 




r ,"a h ti (W?) '? V ? C 5 ????($ 

overed^advert i sing^ webs i t es for the members only website 


which 
,1 account were 
is one out of three 


Additional information provided by YAHOO ' INC, listed the following as 
subscriber for the related email account (b)(6), (b)(7)(C) 


Name : 

First Address: 

Phone : 

Email : 

Credit Card: 
Service : 

Registration IP: 
Second Address : 
Country : 

Birth Date: 
Account Created: 
Deactivation Date: 


(b)(6), (b)(7)(C) 


Potomac. MD 20854 

(b)(6), (b)(7)(C) 


Domains 

69.226.252.20 

Central African Republic 
September 9, 1967 
July 12, 2006 
August 13, 2006 


Public access data bases indicate that the IP address belongs to DTAG Global 
IP -Addressing in Nuernberg, Germany. No TECS records have been found on the 
subject or the address. 
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CASE NUMBER I (b)(7)(E) | 

REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: Oil 


This investigation continues. 
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'"TITLE": COMMERICAL CP WEBSITE KNOWN AS Lg? 
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PAGE 

1 


CASE 

NUMBER | 

(b)(7)(E) r 


CASE STATUS: 

INTERIM RPT 



REPORT DATE 

DATE ASSIGNED 

PROGRAM CODE 

REPORT NO. 

092106 

072606 

EH 

012 

RELATED CASE NUMBERS: 

COLLATERAL REQ: 

TYPE OF REPORT 




OTHER INFORMATION 



TOPIC: RESPONSE FROM JUNO INC. REGARDING SEPTEMBER 11, 2006 

SEARCH WARRANT 


SYNOPSIS : 

On July 24, 2006, the Resident Agent in Charge, Birmingham, Alabama (RAC/BI) 
received a collateral request from the Immigration and Customs Enforcement, 
Cyber Crimes Center (C3) , regarding a lead from the National Center for 
Missing and Exploited Children (NCMEC) . Information from NCMEC related to a 
.website, hfctp;//w.irefreeq^flv.cQm. reported ap, .offering child poi-nogi-aphy, 


(b)(3): 18 U.S.C. § 3509(d) Child victims' and child witnesses’ rights,(b)(3>:18 U.S.C. § 3509(d) (Federal Victims' Protection and Rights Act), (b)(6), (b)(7)(C), (b)(7)(E) 


On September 20, 2006, the office of the Resident Agent in Charge received one 
compact disc from JUNO ONLINE SERVICES in res ponse to a search war rant issued 
to the company for contents of email account | cwUne^ ^hMb 1 )^ 


DISTRIBUTION: 

SIGNATURE: 

| (b)(7)(E) | 

i | (b)(6), (b)(7)(C) | SPECIAL AGENT 



APPROVED : 

j | (b)(6), (b)(7)(C) | RAC -RESIDENT AGENT IN 

ORIGIN OFFICE: BI 
BIRMINGHAM, AL - RAC 

TELEPHONE: 205 7 2|™ 0 ^ / '| 

TYPIST: 1 (b)(6), (b)(7)(C) 1 
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CASE NUMBER | (b)(7)(E) | 

REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: 012 


DETAILS 'OF INVESTIGATION: 


On July 24, 2006, the Resident Agent in Charge, Birmingham, Alabama (RAC/BI) 
received a collateral request from the Immigration and Customs Enforcement, 
Cyber Crimes Center (C3), regarding a lead from the National Center for 
Missing and Exploited Children (NC MEC) . Information from NCMEC related to a 

I . ' U JW- 1 5 ---".‘‘i Ul i U UMU . "1 Tannv-ho^ ^ f ~1 a 


(b)(3): 1 8 U.S.C. § 3509(d) Child victims' and child witnesses' rights, (b)(3): 18 U.S.C. § 3509(d) (Federal Victims' Protection and Rights Act), (b)(8), (b)(7)(C), (b)(7)(E) 


On September 20, 2006, the office of the Resident Agent in Charge received one 
compact disc from JUNO ONLINE SERVICES in response to a search warrant issued 

■*"- 'J tj !ibljy(d) Ihild vir' * 


to the company for contents of email account (2 


is units miiai ir » s t sauna I • 


I (b)(3): 1 8 U.y.U. K 3buy(d) Child victims' and I , , , . . .. 

I child witnesaea' rinhts "hiVsv 1 8 1 1 s c. s 35(191 1 email account was 1 is ted as a primary email account for 
|(b)(6),Vb>(7>(c)| within her Paypal account subscriber information. As stated above, 
this s a me ^ P|.y|^ <^oun was^utili zed to facilitate payments to members only 
website | ig s mm (^a'" ^ I • 


The contents of the response included one (1) compact disc with emails 
retained by JUNO along with a document listing log data and subscriber 
information. Subscriber information included the following: 


NAME: 

ADDRESS j 
CITY: 

STATE : 

ZIP CODE: 

COUNTRY : 

Credit Card Number: 
CW2/CID: 

Expiration Date.- 
HOME PHONE: 

MEMBER JOIN DATE: 
IP: 


(b)(6), (b)(7)(C) 


Chehalis 

WA 

98532 
US 


(b)(6), (b)(7)(C) 


Publicly accessible database checks revealed that the IP address utilized to 
initiate the account is registered to Charter Communication. Other IP 
addresses listed within log data included SBC Wireless, AT&T, and Comcast 
Communications . 


Accurint database information for the above address listed a I (b)(6) (b)(7)(C) ~] , 
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CASE NUMBER 1 ( b >( 7 >( E > T 

REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: 012 


(b)(S), (b)(7)(c> | . This information was utilized to conduct 


TECS queries which returned two international mail facility seizures listing 
the following information: 


SEIZURE NUMBER 
SEIZURE DATE: 
SEIZURE TITLE: 


(b)(7)(E) 


04/14/1999 

Mail seizure of Bestiality Pornography (Oakland) 
COUNTRY OF ORIGIN : NE THERLANDS 
ADDRESSED TO : 


Chehalis, WA 98532 


SEIZURE NUMBER: I (b)(7)(E> I 

SEIZURE DATE: 05/04/1999 

SEIZURE TITLE: Mail seizure of Bestiality Pornography (Oakland) 

COUNTRY OF ORIGIN : NETHERLANDS 


Chehalis, WA 98532 


Travel records listed two travel records in December of 2004, after subject 
departed the United States for St. Thomas, USVI on a Cruise Ship. 


Criminal history checks revealed one Driving While Intoxicated charge in 1987 
in Olympia, WA. 


This investigation continues. 
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NVESTIGATION 


TITLE: COMMERICAL ~CP WEBSITE KNOWN AS LiSI 


TECS ACCESS CODE 


CASE number! 


CASE STATUS: 


INTERIM RPT 


REPORT DATE 

DATE ASSIGNED 

3 :W.t\ ns ! 

REPORT NO. 

092106 

072606 

|(b)(7)(E)| 

013 


RELATED CASE NUMBERS: 


COLLATERAL REQ: 


TYPE OF REPORT: 
OTHER INFORMATION 


TOPIC: RESPONSE FROM CHARTER COMMUNICATIONS - SEPT. 11, 2006 SEARCH WARRANT 


SYNOPSIS: 

On July 24, 2006, the Resident Agent in Charge, Birmingham, Alabama { RAC/BI } 
received a collateral request from the Immigration and Customs Enforcement, 
Cyber Crimes Center (C3) , regarding a lead from the National Center for 
Missing and Exploited Children (NCMEC) . Information from NCMEC related to a 
website, http://wirefreecandv.com, reported as offering child pornography. 


(b)(3): 18 U.S.C. § 3509(d) Child victims' and child witnesses’ rights, (b)(3): 18 U.S.C. § 3509(d) (Federal Victims' Protection and Rights Act), (b)(3), (b)(7)(C), (b)(7)(E) 


On September 20, 2006, the office of the Resident Agent in Charge received one 
compact disc from CHARTER COMMUNICATIONS in respons e to as earch warrant 
issued to the company for contents of email account I ! • 


DISTRIBUTION: 


(b)(7)(E) | 

1 (b)(7)(E) 

_| SPECIAL AGENT f 


APPROVED : 1 


1 (b)(7)(E) 

_J RAC- RESIDENT AGENT IN 


ORIGIN OFFICE: BI 

TELEPHONE: 205 ll ™7A“'" 1 


BIRMINGHAM, AL - RAC 

_ 



TYPIST: | (b)(3), (b)(7)(C) | 
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REPORT NUMBER: 013 


DETAILS OF INVESTIGATION: 


On July 24, 2006, the Resident Agent in Charge, Birmingham, Alabama (RAC/BI) 
received a collateral request from the Immigration and Customs Enforcement, 
Cyber Crimes Center (C3) , regarding a lead from the National Center for 
Missing a nd 1 , g i nq mh c ) . Information from NCMEC related to a 

website. '^1. r eported as offering child pornography. 


(b)(3): 1 8 U.S.C. § 3509(d) Child victims' and child witnesses' rights, (b)(3): 18 U.S.C. § 3509(d) (Federal Victims' Protection and Rights Act), (b)(6), (b)(7)(C), (b)(7)(E) 


On September 20, 2006, the office of the Resident Agent in Charge received one 
compact disc from CHARTER COMMUNICATIONS in respons e to a search warrant 
issued to the company for contents of email account 

I JSSJ," I is listed as a secondary email acc ount within riwjiuwmici I 
Paypal subscriber information. As stated above , I (b)(6), (b)(7)(C) | Paypal account is 


being utilized to facilitate payments to members only website 
I JK,ri« a N "Si” I , a website responsible for the distribution of 

hundreds of images of child pornography. 

Information received from CHARTER COMMUNICATIONS included the following: 


NAME: 
ADDRESS : 


ACCOUNT : 

TELEtfl: 

LENGTH OF SERV : 
TYPE OF SERVICE 
METHOD OF PAY: 

EMAIL ADDRESS : 



02/13/2006 -Present 
High-Speed Internet Service 

No credit card or bank account information; account paid 

,by cash or check 


L 


(b)(7)(E) 


This investigation continues. 
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CASE NUMBER C 
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CASE STATUS: 

INTERIM RPT 



REPORT DATE 
042407 

DATE ASSIGNED 
072606 

■ . i ' 1 1 ■ i i m 

mil mm 

REPORT NO. 
016 

RELATED CASE NUMBERS: 

COLLATERAL REQ : 

TYPE OF REPORT 




OTHER INFORMATION 




TOPIC: WEBSITES CONTAINING CHILD PORNOGRAPHY 


SYNOPSIS : 

Project Flicker (q^j) is an ongoing joint investigation between Immigration 
and Customs Enforcement (ICE) , Resident Agent in Charge, Birmingham, Alabama 
( RAC/BI) , ICE Cyber Crimes Center (C3/CES) , the Postal Inspection Service, the 
United States Attorney's Office for the Northern District of Alabama, and 
Department of Justice/CEOS that has targeted both the principles facilitating 
subscription payments and the actual subscribers of several commercial child 
exploitation member restricted websites. The project has identified at least 
18 separate child exploitation member restricted websites and approximately 13 
principles responsible for the collection of the associated monthly 
subscription fees. 


(b)(7)(E) 


1 1 1 'HTTiy^ygM^M 

M M ■■I! 


H ii i ■ 'i ii j 


APPROVED : 

| (b)(6), (b)(7)(C) | SENIOR SPEC AGENT 

ORIGIN OFFICE: BI 
BIRMINGHAM, AL - RAC 

TELEPHONE : 205 721 1 

TYPIST: | (b)(6), (b)(7)(C) | 
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DETAILS OF INVESTIGATION: 


Project Flicker (I I) is an ongoing joint investigation between Immigration 
and Customs Enforcement (ICE) , Resident Agent in Charge, Birmingham, Alabama 
(RAC/BI) , ICE Cyber Crimes Center (C3/CES) , the Postal Inspection Service, the 
United States Attorney's Office for the Northern District of Alabama, and 
Department of Justice/CEOS that has targeted both the principles facilitating 
subscription payments and the actual subscribers of several commercial child 
exploitation member restricted websites. The project has identified at least 
18 separate child exploitation member restricted websites and approximately 13 
principles responsible for the collection of the associated monthly 
subscription fees . 



OFFICIAL USE ONLY 

THIS DOCUMENT IS LOANED TO YOU FOR OFFICIAL USE ONLY AND REMAINS THE PROPERTY 
OF THE DEPARTMENT OF HOMELAND SECURITY, ICE. ANY FURTHER REQUEST FOR 
DISCLOSURE OF THIS DOCUMENT OR INFORMATION CONTAINED HEREIN SHOULD BE REFERRED 
TO ICE HEADQUARTERS TOGETHER WITH A COPY OF THE DOCUMENT. 


Page 351 of 929 












OFFICIAL USE ONLY 


DEPARTMENT 

OF 

HOMELAND SECURITY 

PAGE 4 



ICE 


REPORT OF 

I 

NVESTIGATION 

CASE NUMBER | (b)(7)(E) | 

C 0 N T 

I 

N U A T I O N 

REPORT NUMBER: 016 


(b)(3): 18 U.S.C. § 3509(d) Child victims' and child witnesses' rights, (b)(3): 18 U.S.C. § 3509(d) (Federal Victims' Protection and Rights Act), (b)(8), (b)(7)(C), (b)(7)(E) 
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REPORT NUMBER: 016 


(b)(3): 18 U.S.C. § 3509(d) Child victims' and child witnesses' rights, (b)(3): 18 U.S.C. § 3509(d) (Federal Victims' Protection and Rights Act), (b)(8), (b)(7)(C), (b)(7)(E) 


OFFICIAL USE ONLY 

THIS DOCUMENT IS LOANED TO YOU FOR OFFICIAL USE ONLY AND REMAINS THE PROPERTY 
OF THE DEPARTMENT OF HOMELAND SECURITY, ICE. ANY FURTHER REQUEST FOR 
DISCLOSURE OF THIS DOCUMENT OR INFORMATION CONTAINED HEREIN SHOULD BE REFERRED 
TO ICE HEADQUARTERS TOGETHER WITH A COPY OF THE DOCUMENT. 


Page 354 of 929 












OFFICIAL USE ONLY 


DEPARTMENT OF HOMELAND SECURITY 
ICE 

PAGE 7 


CASE NUMBER | (b)(7)(E) j 

REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: 016 

MEMBER RESTRICTED WEBSITE DESCRIPTIONS: 
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TITLE: COMMERICAL CP WEBSITE KNOWN AsESSS 


m 


TECS ACCESS CODE 


CASE NUMBER | (b)(7)(E) 

!. y !ibl)9(d) Uh.ld I 


CASE STATUS: INTERIM RPT 

REPORT DATE 
070507 

DATE ASSIGNED 
072606 

PROCj 

5 !P( 55 

Bj jtfjj 

REPORT NO. 
« 031 


RELATED CASE NUMBERS: 


COLLATERAL REQ : 


TYPE OF REPORT: 

SEARCH WARRANT REPORT / 


TOPIC: SEARCH WARRANT SERVED ON J2 GLOBAL INC. FOR E-FAX INFORMATION 


SYNOPSIS: 

Project Flicker (2S2) is an ongoing joint investigation between Immigration 
and Customs Enforcement (ICE), Resident Agent in Charge, Birmingham, Alabama 
(RAC/BI) , ICE Cyber Crimes Center (C3/CES) , the Postal Inspection Service, the 
United States Attorney's Office for the Northern District of Alabama, and 
Department of Justice/CEOS targeting both the principles facilitating 
subscription payments and the subscribers of commercial child exploitation 
member restricted websites. The project has identified 18 separate child 


(b)(3): 1 8 U.S.C. § 3509(d) Child victims' and child witnesses' rights, (b)(3): 18 U.S.C § 3509(d) (Federal Victims' Protection and Rights Act), (b)(6), (b)(7)(C), (b)(7)(E) 


On June 14, 2007 in the Northern District of Alabama, United States Magistrate 
Judge John E. Ott signed a federal search warrant, commanding search of two 
electronic facsimile phone number accounts provided by J2 Global Incorporated. 
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CASE NUMBER I (b)(7)(E) 


REPORT NUMBER: 031 


DETAILS OF INVESTIGATION: 

Project Flicker fl (I ? b 7> I ) is an ongoing joint investigation between Immigration 
and Customs Enforcement (ICE) , Resident Agent in Charge, Birmingham, Alabama 
(RAC/BI) , ICE Cyber Crimes Center (C3/CES) , the Postal Inspection Service, ti 
United States Attorney's Office for the Northern District of Alabama, and 
Department of Justice/CEOS targeting both the principles facilitating 
subscription payments and the subscribers of commercial child exploitation 
member restricted websites. The project has identified 18 separate child 
exploitation websites and approximately 14 pr inciples responsible for the 
collection of the monthly subscription fees. I ( b >( 7 « E > 


On June 14, 2007 in the Northern District of Alabama, United States Magistrate 
Judge John E. Ott signed a federal search v/arrant, comm anding search of J2 
Global electron ic facsimile phone number accounts 321-28 F )ia /A 0)1 and 

I (b)(8), (b)(7)(C) I. 


Representatives with J2 Global, located in Los Angeles, California indicated 
that electronic facsimile content is saved on J2 Global ' s server during 
routine course of business, and is maintained for up to one year. The above 
listed phone numbers also have voice capability. 

These phone numbers were discovered during the course of the investigation in 
various areas within the PayPal account holders information. 

The following is 
limited to: 


a list of areas where Q 


^ was located, but not 


(b)(6).(b)(7)(C), (b)(7)(E) 
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In May of 2007, agents were advised by officials of J2 Global Communications, 
Los Anqeles, California of the following information regarding phone number 
321-28SS 


Electronic Fax Numbe 
Subscriber Name: 
Subscriber Business : 
Address : 

Home Number: 

E-mail : 


Representatives nf J2 Global indicated that the home number listed for 1 1Dn 7A Dn,) I 
| (b)(6), (b)(7)(C) | was also provided by J2 Global and subscribed to by the 

following: 


• | (b)(6), (b)(7)(C) | 

Lencomps LTD 

(b)(6), (b)(7)(C) 

(b)(6), (b)(7)(C) j uno . com 


Electronic Fax Number: 
Subscriber Name: 
Subscriber Business : 
Address : 


, Lane, quips .LTD. 

(b)(3): 18 U S. C. § 3509(d) Child victims and child 
witnesses' rights,(b)(3):18 U.S.C. § 3509(d) (Federal 
Victims' Protection and Rights Act), (b)(6), (b)(7)(C) 


PayPal Account holder f (b)(6), (b)(7)(C) | provided investigators with information 

regarding her activities after PayPal restricted her account. Agents of the 
npnvpr. fini nrad n ICE office interviewed her and discovered that phone number 
| (b)(6), (b)(7)(C) | wag provided to her by a subject repr esente d as a human 

resource manager with a company called LENCOMPS LTD. | |b>lb ( > c ( i bi(/i | indicated that 
this number was provided fo r her to fax her emp loyment documents to along with 
above referenced fax number ESSZSSS1 • (ref: I (b)(7)(E) I ) . 

The above referenced search warrant, signed on June 14, 2007, was also served 
on this same date to J2 Global of Los Angeles, California via facsimile, and 
DHS mail. * 

This investigation continues. 
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CASE STATUS: 

INTERIM RPT 




REPORT DATE 

DATE ASSIGNED 

PROGI 

? AM CODE 

REPORT NO. 

070507 

072606 

m 

032 

RELATED CASE NUMBERS: 

COLLATERAL REQ: 

TYPE OF REPORT 





1 SEARCH WARRANT REPORT / 




TOPIC: SEARCH WARRANT ISSUED FOR TIME WARNER ROADRUNNER 


SYNOPSIS: 

Project Flicker j | ) is an ongoing joint investigation between Immigration 
and Customs Enforcement (ICE) , Resident Agent in Charge, Birmingham, Alabama 
(RAC/BI) , ICE Cyber Crimes Center (C3/CES) , the Postal Inspection Service, the 
United States Attorney's Office for the Northern District of Alabama, and 
Department of Justice/CEOS targeting both the principles facilitating 
subscription payments and the subscribers of commercial child exploitation 
member restricted websites. The project has identified 18 separate child 
exploitation websites and approximately 14 principles responsible for the 
collection of the monthly subscription fees. Over 60 I (b)(7)(E) | 

conducted, have identified approximately 14 PayPal accounts holders 
processing payments for the criminal organization. 


On June 14, 2007 in the Northern District of Alabama, United States Magistrate 
Judge Jo hn E. Ott signed a federal search war rant, commanding search of e-mail 
a ccounts I “u»(a>.v h ! ld VK ? ms and child witnesses rights (b)(3) is located at Time Warner Cable. 





[ (b)(6), (b)(7)(C) 1 SPECIAL AGENT 



. APPROVED; . 

| (b)(6), (b)(7)(C) | oi GRP SUPERVISOR 

ORIGIN OFFICE: BI 
BIRMINGHAM, AL - RAC 

TELEPHONE: 205 72l W 7A“ A " 1 

TYPIST ; 1 (b)(6), (b)(7)(C) | 
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CASE NUMBER | (b)(7)(E) f 

REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: 032 


DETAILS OF INVESTGIATION : 


Project Flicker j l > is an ongoing joint investigation between Immigration 
and Customs Enforcement (ICE) , Resident Agent in Charge, Birmingham, Alabama 
(RAC/BI) , ICE Cyber Crimes Center (C3/CES) , the Postal inspection Service, the 
United States Attorney's Office for the Northern District of Alabama, and 
Department of Justice/CEOS that has targeted both the principles facilitating 
subscription payments and the actual subscribers of several commercial child 
exploitation member restricted websites. The project has identified at least 
18 separate child exploitation member restricted websites and approximately 14 
principles responsi ble for the collection of the associated monthly 


subscription fees. | 


(b)(7)(E) 

I (b)(7)(E) 


On June 14, 2007 in the Northern District of Alabama, United States Magistrate 
Judge Jo hn 5- Ott signed a federal search war rant, commanding search of e-mail 

account" si (b)(3): 18U SC § 3509(d) Child victims ond child witnesses rights (b)(3) 18 I 1 ah Time Warner Cable 

accounts) s (FrtOT | Ylflims . find I iocacea ac iime earner table. 


The Time Warner Cable /Roadrunner e-mail accounts are related to two of the 14 
PayPal accounts identified, which are responsible for co llecting payme nts from 

18 different child pornographic websites. Specifically , l^ms^ndcMdTtn I 

liste d as an e-mail address within the PavPal account in format ion tori EEUZEEZEsD 

r°7wr°1 of Wilson, North C arol ina , I (b)(6), (b)(7)(C) ) , a PayPal account holder in 

Sanford, Florida, lists I within his PayPal profile. 


On June 15, 2007, the above referenced search warrant was served to Time 
Warner Cable, Inc. via facsimile, and DHL mail express. 
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REPORT OF INVESTIGATION 

CASE NUMBER | (b)(7)(E) 


TITLE: COMMERICAL CP WEBSITE KNOWN AS 1 

CASE STATUS: 

INTERIM RPT 



REPORT DATE 
070507 

DATE ASSIGNED 
072606 

PROGRAM. CODE 

m 

REPORT NO. 
033 

RELATED CASE NUMBERS: 

COLLATERAL REQ : 

TYPE OF REPORT 




SEARCH WARRANT REPORT / 



TOPIC: SEARCH WARRANT SERVED ON CHARTER 

COMMUNICATIONS 



SYNOPSIS: 

Project Flicker {2S2) is an ongoing joint investigation between Immigration 
and Customs Enforcement (ICE) , Resident Agent in Charge, Birmingham, Alabama 
(RAC/BI) , ICE Cyber Crimes Center (C3/CES) , the Postal Inspection Service, the 
United States Attorney's Office for the Northern District of Alabama, and 
Department of Justice/CEOS targeting both the principles facilitating 
subscription payments and the subscribers of commercial child exploitation 
member restricted websites. The project has identified 18 separate child 
exploitation websites and approximately 14 pr inciples responsible for the 
collection of the monthly subscription fees. I (b)(7)(E) | 

(b)(7)(E) I 


On June 14, 2007 in the Northern District of Alabama, United States Magistrate 
Judge John E. Ott signed a federal search warrant, commanding search of three 
e-mail accounts located at Charter Communication, Inc. 



SIGNATURE : 

(b)(7)(E) | 

1 (b)(6). (b)(7)(C) 1 SPECIAL AGENT 



APPROVED : 

L OI GRP SUPERVISOR 

ORIGIN OFFICE: BI 
BIRMINGHAM, AL - RAC 

TELEPHONE: 205 73 1 

TYPIST: I (b)(6), (b)(7)(C) | 
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CASE NUMBER I (b)(7)(E) I 

REPORT NUMBER: 033 


CASE PROGRAM CODES: 


(b)(7)(E) 


OFFICIAL USE ONLY 

THIS DOCUMENT IS LOANED TO YOU FOR OFFICIAL USE ONLY AND REMAINS THE PROPERTY 
OF THE DEPARTMENT OF HOMELAND SECURITY, ICE. ANY FURTHER REQUEST FOR 
DISCLOSURE OF THIS DOCUMENT OR INFORMATION CONTAINED HEREIN SHOULD BE REFERRED 
TO ICE HEADQUARTERS TOGETHER WITH A COPY OF THE DOCUMENT. 


Page 375 of 929 




OFFICIAL USE ONLY 


DEPARTMENT OF HOMELAND SECURITY 
ICE 

REPORT OF INVESTIGATION 
CONTINUATION 


PAGE 3 

"CASE NUMBER I (b)(7)(E) 

REPORT NUMBER: 033 


DETAILS OF INVESTGIATION : 


Project Flicker (2S2) is an ongoing joint investigation between Immigration 
and. Customs Enforcement (ICE) , Resident Agent in Charge, Birmingham, Alabama 
(RAC/BI), ICE Cyber Crimes Center (C3/CES) , the Postal Inspection Service, the 
United States Attorney's Office for the Northern District of Alabama, and 
Department of Justice/CEOS targeting both the principles facilitating 
subscription payments and the subscribers of commercial child exploitation 
member restricted websites. The project has identified 18 separate child 
exploitation websites and approximately 14 pr inciples responsible for the 
collection of the monthly subscription fees. I (b)(7)( E) 1 

(b)(7)(E) I 


On June 14, 2007 in the Northern District of Alabama, United States Magistrate 
Judge Jo hn E. Ott signed a federal search warrant, commanding search of 
accounts I (b)(6>.(b)(7)(c> | , and 

(b)(6), (b)(7)(C) 1 located at Charter Communication, Inc. 


E-mail accounts^ 


(b)(6), (b)(7)(C) 




(b)(6), (b)(7)(C) [ , and 

t are re lated to PayPal account holder targe t s 
(b)(6) (b)(7)(C) | . and have been utilized to correspond with 

subscribers of child nor noa ran hie websites, as well as with a subiect 
utilizing the name oflSSand email address E 


and [ 


The above reference search warrant was served on June 14, 2007 via facsimile 
and DHL mail . 


This investigation continues . 


OFFICIAL USE ONLY 

THIS DOCUMENT IS LOANED TO YOU FOR OFFICIAL USE ONLY AND REMAINS THE PROPERTY 
OF THE DEPARTMENT OF HOMELAND SECURITY, ICE. ANY FURTHER REQUEST FOR 
DISCLOSURE OF THIS DOCUMENT OR INFORMATION CONTAINED HEREIN SHOULD BE REFERRED 
TO ICE HEADQUARTERS TOGETHER WITH A COPY OF THE DOCUMENT. 


Page 376 of 929 






DEPARTMENT OF HOMELAND SECURITY 
ICE 


REPORT OF INVESTIGATION 


TITLE: COMMERICAL CP WEBSITE kSoWH AS LS? g”* 


O N L 

Y 


TECS 

ACCESS 
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PAGE 
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CASE 

NUMBER 

(b)(7)(E) | 


CASE STATUS: 


INTERIM RPT 


REPORT DATE 

DATE ASSIGNED 

PROGRAM CODE 1 

REPORT NO. 


070507 

072606 


034 



RELATED CASE NUMBERS: 


COLLATERAL REQ: 


TYPE OF REPORT: 

SEARCH WARRANT REPORT / 


TOPIC: SEARCH WARRANT SERVED ON MSN HOTMAIL, INC. 


Project Flicker (2S2) is an ongoing joint investigation between Immigration 
and Customs Enforcement (ICE) , Resident Agent in Charge, Birmingham, Alabama 
(RAC/BI) , ICE Cyber Crimes Center (C3/CES) , the Postal Inspection Service, the 
United States Attorney's Office for the Northern District of Alabama, and 
Department of Justice/CEOS targeting both the principles facilitating 
subscription payments and the subscribers of commercial child exploitation 
member restricted websites. The project has identified 18 separate child 

exploitation websites and approximately 14 pr inciples responsible for the 

collection of the monthly subscription fees. 1 (b)(7)(E) \ 

(b)(7)(E) 


On June 14, 2007 in the Northern District of Alabama, United States Magistrate 
Judge John E. Ott signed a federal search warrant, commanding search of a list 
of five email accounts located at MSN Hotmail, Inc., in Mountain View, 


DISTRIBUTION; 


(b)(7)(E) | 



| | (b)(6), (b)(7)(C) | SPECIAL AGENT 

APPROVED : 

| (b)(6), (b)(7)(C) | 01 GRP SUPERVISOR 

ORIGIN OFFICE: BI 
BIRMINGHAM, AL - RAC 

TELEPHONE: 205 731 '“'7A U ' 1 " 1 

TYPIST : I (b)(6), (b)(7)(C) | 
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CASE NUMBER | (b)(7)(E) | 

REPORT OF 

I 

NVESTIGATION 


C O N T 

I 

N U A T I O N 

REPORT NUMBER: 034 


California. 

DETAILS OF INVESTGIATION : 


Project Flicker ( I^rI ) is an ongoing joint investigation between Immigration 
and Customs Enforcement (ICE), Resident Agent in Charge, Birmingham, Alabama 
(RAC/BI) , ICE Cyber Crimes Center (C3/CES) , the Postal Inspection Service, the 
United States Attorney's Office for the Northern District of Alabama, and 
Department of Justice/CEOS that has targeted both the principles facilitating 
subscription payments and the actual subscribers of several commercial child 
exploitation member restricted websites. The project has identified at least 
18 separate child exploitation member restricted websites and approximately 14 

principles responsi ble for the collection of the associated monthly 

subscription fees . I (b)(7)(E) | 

(b)(7)(E) I 


On June 14, 2007 in the Northern District of Alabama, United States Magistrate 
Judge John E. Ott signed a federal search warrant, commanding search the 
following list of five email accounts located at MSN Hotmail, Inc., in 
Mountain View, California. 


(b)(3): 18 U.S.C. § 3509(d) Child victims' end child witnesses' 
rights,(b)(3): 1 8 U.S.C. § 3509(d) (Federal Victims' Protection 
and Rights Act), (b)(6), (b)(7)(C) 


The above referenced search warrant was served via facsimile and DHL mail to 
MSN Hotmail, Inc., Building 4, 1065 La Avenida, Mountain Vie, California. 

This investigation continues. 
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TITLE: COMMERICAL CP WEBSITE KNOWN“aS^S2S 


TECS ACCESS CODE 1ST 


PAGE 1 

CASE NUMBER I (b)(7)(E) T 


CASE STATUS: 

INTERIM RPT 



REPORT DATE 
070507 

DATE ASSIGNED 
072606 

PROGRAM CODE 

PHI 

REPORT NO. 
035 

| RELATED CASE NUMBERS: 



COLLATERAL REQ : 

TYPE OF REPORT: 

SEARCH WARRANT REPORT / 

TOPIC: SEARCH WARRANT SERVED ON GOOGLE, 

INC. 

1(b)(3) 18 USt 5'JbUa(d)| 



Project Flicker I “S' t is an ongoing joint investigation between Immigration 

and Customs Enforcement (ICE) , Resident Agent i 1 (bj( 6 >(b>( 7 >(c> “ Irmingham, Alabama 

(RAC/BI) , ICE Cyber Crimes Center (C3/CES) , thy postal inspection Service, the 
United States Attorney's Office for the Northern District of Alabama, and 
Department of Justice/CEOS targeting both the principles facilitating 
subscription payments and the subs<| (b >(7)(E> p °f commercial child exploitation 
i -IBffJVisu ' ij.u AuoiavLRi i d v.gtilris — \s . The ptoi 6CC has i f ' ww j st ifl a r ieparate child 

■ « u.m. 5 aw W 14 pri te t ^ ^ ^Msible for the 


collection of the mon t h !^ 1 fees. Over 60 L 


conducted, have identified approximately 14 PayPal accounts holders processing 
payments for the criminal organization. 


On June 14, 2007 in the Northern District of Alabama, United States Magistrate 
Judge John E. Ott signed a federal search warrant, commanding search of a list 
of seven email accounts located at Google, Inc. in Mountain View, California. 


DISTRIBUTION: 
RACBI SACNO SACKS 

SIGNATURE: 

| (b)(6) (b)(7)(C) | SPECIAL AGENT 

H ■QMOl 

APPROVED: 

| (b)(6>, (b>(7>(C> | oi GRP SUPERVISOR 


ORIGIN OFFICE: BI 
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TYPIST: | (b>(6), (b)(7)(C) | 
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CASE NUMBER | (b)(7)(E) | 

REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: 035 


DETAILS OF INVESTGIATION : 


Project Flicker (2S2) is an ongoing joint investigation between Immigration 
and Customs Enforcement (ICE), Resident Agent in Charge, Birmingham, Alabama 
(RAC/BI) , ICE Cyber Crimes Center (C3/CES) , the Postal Inspection Service, the 
United States Attorney's Office for the Northern District of Alabama, and 
Department of Justice/CEOS targeting both the principles facilitating 
subscription payments and the subscribers of commercial child exploitation 
member restricted websites. The project has identified 18 separate child 

exploitation websites and approximately 14 pr inciples responsible for the 

collection of the monthly subscription fees . I (b)(7)(E) | 

I (b)(7)(E) 1 


On June 14, 2007 in the Northern District of Alabama, United States Magistrate 
Judge John E. Ott signed a federal search warrant, commanding search of the 
following seven email accounts located at Google, Iqc. in Mountain View, 
California. 


(b)(3): 18 U.S.C. § 3509(d) Child victims’ and child 
witnesses' rights, (b)(3): 1 8 U.S.C. § 3509(d) (Federal 
Victims' Protection and Rights Act), (b)(6), (b)(7)(C) 


E-mail accountl 

(b)(6), (b)(7)(C) 

1 is associated with PayPal account holder 

| (b)(6), (b)(7)(C) | , 

who lists 

it within his PayPal profile information. 




E-mail accounts L_ 


(b)(6), (b)(7)(C) | and 

* (b)(6), (b)(7)(C) 

1 is 

associated with PayPal account holder | (b)(6>, (b)(7)(C) | 

| (b)(6), (b)(7)(C) |. 

E-mail account I 

(b)(6), (b)(7)(C) 

| is associated with transactions related to 

child pornography 

website membership purchases. 

E-mail accountl 

(b)(6), (b)(7)(C) 

| is associated with PayPal account houlder 

| (b)(6), (b)(7)(C) | 


E-mail hrrn nnh | (b)(6), (b)(7)(C) | is associated with PayPal account holder 

| (b)(6), (b)(7)(C) |. 


The above listed search warrant was served via facsimile and DHL mail to 
Google, Inc., 1600 Amphitheatre Parkway, Mountain View, California. 
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REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: 035 


This investigation continues. 
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DEPARTMENT OF HOMELAND SECURITY 
ICE 


REPORT OF INVESTIGATION 


TECS ACCESS CODE ( 


PAGE 1 


CASE NUMBER | 

(b)(7)(E) | 


TITLE: COMMERICAL CP WEBSITE KNOWN AS LS’SgZSJ 

CASE STATUS: 

INTERIM RPT 



REPORT DATE 

DATE ASSIGNED 

PROGRAM CODE 

REPORT NO . 

070507 

072606 

LSI 

036 

RELATED CASE NUMBERS: 

COLLATERAL REQ : 

TYPE OF REPORT: 




| SEARCH WARRANT REPORT / 




TOPIC: SEARCH WARRANT SERVED ON YAHOO! INC. 


SYNOPSIS : 

Project Flicker is an ongoing joint investigation between immigration 

and Customs Enforcement (ICE) , Resident Agent in Charge, Birmingham, Alabama 
(RAC/BI) , ICE Cyber Crimes Center (C3/CES) , the Postal Inspection Service, the 
United States Attorney's Office for the Northern District of Alabama, and 
Department of Justice/CEOS targeting both the principles facilitating 
subscription payments and the subscribers of commercial child exploitation 
member restricted websites. The project has identified 18 separate child 
exploitation websites and approximately 14 principles responsible for the . 

,g9llec tion the monthly subscription fees, I (b>(7>1E> , 1 


(b)(7)(E) 


On June 14, 2007 in the Northern District of Alabama, United States Magistrate 
Judge John E. Ott signed a federal search warrant, commanding search of two 
email accounts located at Yahoo! Inc. of Sunnyvale, California. 


DISTRIBUTION: 

SIGNATURE: 

1 (b)(7)(E) | 

| (b)(6), (b)(7)(C) | SPECIAL AGENT 



APPROVED : 

1 (b«6), (b)(7)(C) I 01 GRP SUPERVISOR 

ORIGIN OFFICE: BI 
BIRMINGHAM, AL - RAC 



TELEPHONE: 205 73T“'7fT'" | 

TYPIST: | (b)(6), (b)(7)(C) | 
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CASE NUMBER I ( b >( 7 « E > 1 

REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: 036 


DETAILS OF INVESTGIATION : 


Project Flicker (2S2) is an ongoing joint investigation between Immigration 
and Customs Enforcement (ICE) , Resident Agent in Charge, Birmingham, Alabama 
(RAC/BI) , ICE Cyber Crimes Center (C3/CES) , the Postal Inspection Service, the 
United States Attorney’s Office for the Northern District of Alabama, and 
Department of Justice/CEOS targeting both the principles facilitating 
subscription payments and the subscribers of commercial child exploitation 
member restricted websites. The project has identified 18 separate child 

exploitation websites and approximately 14 pr inciples responsible for the 

collection of the monthly subscription fees. I (b)(7)(E) | 


(b)(7)(E) 


On June 14, 2007 in the Northern District of Alabama, United States Magistrate 
Judge John E. Ott signed a federal search warrant, commanding search of two 
email accounts located at Yahoo! Inc. of Sunnyvale, California. 


(b)(6). (b)(7)(C) 


The above reference search warrant was served via facsimile and DHL mail to 
Google, Inc., 1600 Amphitheatre Parkway, Mountain View, California. 

This investigation continues . 
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RELATED CASE NUMBERS: 


REPORT NO. 
037 


COLLATERAL REQ: 


TYPE OF REPORT: 

SEARCH WARRANT REPORT / 


TOPIC: SEARCH WARRANT SERVED ON JUNO ONLINE SERVICES 


SYNOPSIS: 

Project Flicker (2S2) is an ongoing joint investigation between Immigration 
and Customs Enforcement (ICE) , Resident Agent in Charge, Birmingham, Alabama 
(RAC/BI) , ICE Cyber Crimes Center (C3/CES) , the Postal Inspection Service, the 
United States Attorney's Office for the Northern District of Alabama, and 
Department of Justice/CEOS targeting both the principles facilitating 
subscription payments and the subscribers of commercial child exploitation 
member restricted websites. The project has identified 18 separate child 
exploitation websites and approximately 14 pr inciples responsible for the 
collection of the monthly subscription fees. I (b)(7)(E) 1 

(b)(7)(E) 


On June 14, 2007 in the Northern District of Alabama, United States Magistrate 
Judge John E. Ott signed a federal search warrant, commanding search of five 
e-mail accounts located at Juno Online Services, Inc. of New York, New York. 
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CASE NUMBER" | 

(b)(7)(E) J 


REPORT NUMBER: 037 


DETAILS OF INVESTGIATION : 


Project Flicker ( I is an ongoing joint investigation between Immigration 
and Customs Enforcement (ICE), Resident Agent in Charge, Birmingham, Alabama 
{RAC/BI}, ICE Cyber Crimes Center (C3/CES) , the Postal Inspection Service, the 
United States Attorney's Office for the Northern District of Alabama, and 
Department of Justice/CEOS targeting both the principles facilitating 
subscription payments and the subscribers of commercial child exploitation 
member restricted websites. The project has identified 18 separate child 
exploitation websites and approximately 14 pr inciples responsible for the 
collection of the monthly subscription fees . I (b)(7)(E) I 

I (b)(7)(E) I 


On June 14, 2007 in the Northern District of Alabama, United States Magistrate 
Judge John E. Ott signed a federal search warrant, commanding search of the 
following five e-mail accounts located at Juno Online Services, Inc. of New 
York, New York. 


(b)(6), (b)(7)(C) 


The above reference search warrant was served via facsimile and DHL mail to 
Juno Online Services, Inc., 15th Floor, 120 West 45th Street, New York, New 
York. 


This investigation continues. 
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CASE NUMBER | 

(b)(7)(E) | 


CASE STATUS: 

INTERIM RPT 



REPORT DATE 

DATE ASSIGNED 

PROGRAM CODE 

REPORT NO. 

070507 

072606 

rwi 

038 


RELATED CASE NUMBERS: 


COLLATERAL REQ : 


TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 


TOPIC: RESPONSE RECEIVED FROM YAHOO! INC. CONCERNING 13 EMAIL ACCOUNTS 


SYNOPSIS: 

Project Flicker \ D is an ongoing joint investigation between Immigration 
and Customs Enforcement (ICE) , Resident Agent in Charge, Birmingham, Alabama 
( RAC/BI } , ICE Cyber Crimes Center (C3/CES) , the Postal Inspection Service, the 
United States Attorney's Office for the Northern District of Alabama, and 
Department of Justice/CEOS targeting both the principles facilitating 
subscription payments and the subscribers of commercial child exploitation 
member restricted websites. The project has identified 18 separate child 
exploitation websites and approximately 14 pr inciples responsible for the 
collection of the monthly subscription fees. | (b)(7)(E) | 


(b)(7)(E) 


On June 21, 2007 the office of the Resident Agent in Charge, Birmingham, 
Alabama (RAC/BI) obtained information from Yahoo! Inc. of Sunnyvale, 
California consisting of the contents of thirteen e-mail accounts. 


DISTRIBUTION : 
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CASE NUMBER | (b)(7)(E) | 

REPORT OF INVESTIGATION 


CONTINUATION I 

REPORT NUMBER: 038 


DETAILS OF INVESTGIATION : 


Project Flicker CSJ is an ongoing joint investigation between Immigration 
and Customs Enforcement (ICE), Resident Agent in Charge, Birmingham, Alabama 
(RAC/BI) , ICE Cyber Crimes Center (C3/CES) , the Postal Inspection Service, the 
United States Attorney's Office for the Northern District of Alabama, and 
Department of Justice/CEOS targeting both the principles facilitating 
subscription payments and the subscribers of commercial child exploitation 
member restricted websites. The project has identified 18 separate child 

exploitation websites and approximately 14 pr inciples responsible for the 

collection of the monthly subscription fees . | (b>(7>(E> | 

I (b)(7)(E) 


On June 21, 2007 the office of the Resident Agent in Charge, Birmingham, 
Alabama (RAC/BI) obtained information from Yahoo! Inc. of Sunnyvale, 
California consisting of the contents of thirteen e-mail accounts. 

Information obtained was received based on a search warrant issued on June 1, 
2007, signed by the Honorable United States Magistrate Judge Harwell G. Davis 
of the Northern Di strict of Alabama. E-mail accounts searched include 

.yahoo.* com accounts I ■ I. 

(b)(6), (b)(7)(C) 

(b)(6), (b)(7)(C) | ~l All accounts are related to the facilitation of 

payments received for memberships to several child pornographic websites. 

This investigation contines. 
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TECS ACCESS CODE 
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CASE NUMBER | (b)(7)(E) | 

TITLE: COMMERICAL CP WEBSITE KNOWN AS |,77; 

L 9 JJU^UJ I.I1IIU | 

CASE STATUS: 

INTERIM RPT 




REPORT DATE 

DATE ASSIGNED 

PROG] 

RAM CODE 

REPORT NO. 

100307 

072606 

I 


044 

RELATED CASE NUMBERS: 

COLLATERAL REQ 

CAFE 




TYPE OF REPORT 




, v 

COLLATERAL REQUEST / IN 




TOPIC: COLLATERAL REQUEST TO FRANKFURT, 

GERMANY 




SYNOPSIS : 

The Resident Agent in Charge, Birmingham (RAC/BI) and the Cyber Crimes 
Center (C3) are conducting a joint investigation of the suspected involvement 
of numerous persons in several European nations and the United States in the 
distribution of child pornography through the Internet. Information developed 
during the investigation indicates that the operators of the child pornography 
websites are located in Belarus, Latvia, Russia and the United Kingdom. Those 
website operators have recruited persons in the United States to receive 
credit card payments for monthly subscriptions to the websites and to then 
transfer the proceeds to them (the operators) in Eastern Europe. 

The ICE Attache, Frankfurt is respectfully requested to provide 
assistance in fully identifying the operators of the child pornography 
websites . 


DISTRIBUTION: 

SIGNATURE: 

| (b)(7)(E) | 

I (b)(6), (b)(7xc> l special Agent 



APPROVED : 

| (b)(6), (b)(7)(C) I OI GRP SUPERVISOR 

ORIGIN OFFICE: BI 
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CASE NUMBER! (b)(7)(E) | 

REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: 044 


DETAILS OF' INVESTIGATION: 


The Resident Agent in Charge, Birmingham {RAC/BI } and the Cyber Crimes 
Center (C3) are conducting a joint investigation of the suspected involvement 
of numerous persons in several European nations and the United States in the 
distribution of child pornography through the Internet. Information developed 
during the investigation indicates that the operators of the child pornography 
websites are located in Belarus, Latvia, Russia and the United Kingdom. Those 
website operators have recruited at least fourteen (14) persons in the United 
States to receive credit card payments for monthly subscriptions to the 
websites and then transfer the payments to them (the operators) in Europe. 

The investigation was initiated in April, 2006, when I (b>(6>,(b>(7>(c> | . 

Senior Specia l Agent. U.S. Immigration and Customs Enforcement, Cyber Crimes 
Center, began l (b)(7)(E) I of monthly subscriptions to various 

member-restricted child pornography websites. During the next fifteen (15) 
months, he made more than one hundred ( 100 ) purchases of subscriptions to 
eighteen (18) different child pornography websites, all of which appear to be 
associated with one another. I (b>(6>,(b>(7>(c>(b>(7>(E> | 

(b)(6), (b)(7)(C), (b)(7)(E) 


Investigators have obtained Paypal records and banking records for each 
of the fourteen (14) Paypal account owners in the United States. They have 
identified from those records more than five thousand (5,000) subscribers to 
the child pornography websites. They have further determined that the Paypal 
account owners have collected more than one million five hundred thousand 
dollars ($1,500,000.00) in subscription payments and have transferred most of 
those proceeds to individual recipients in Belarus, Latvia and Russia. 

Investigators have also executed search warrants to obtain copies of 
email messages sent and received by the fourteen (14) Paypal account holders 
and have conducted interviews of four (4) of the account holders. The 
investigators have determined from the email messages and interviews that it 
is likely that most or all of the Paypal account owners in the United States 
did not know the nature of the funds they were receiving and were therefore 
unaware of their involvement in facilitating the distribution of child 
pornography. Each of them appears to have been recruited through the Internet 
to establish "work at home" businesses involved in processing Paypal payments 
for ostensibly legitimate products, such as computer anti-virus software 
packages . 

Bank records obtained by investigators establish that funds 
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CASE NUMBER I (b)(7)(E) | 

REPORT NUMBER: 044 


representing the proceeds of the sale of subscriptions to the child 
pornography websites were transferred by the fourteen (14) Paypal account 
holders to the following persons: 


(b)(6), (b)(7)(C) 


UNDEVELOPED LEADS: 

THE ICE ATTACHE, FRANKFURT, GERMANY: 

The ICE Attache, Frankfurt, is respectfully requested to conduct logical 
OFFICIAL USE ONLY 

THIS DOCUMENT IS LOANED TO YOU FOR OFFICIAL USE ONLY AND REMAINS THE PROPERTY 
OF THE DEPARTMENT OF HOMELAND SECURITY, ICE. ANY FURTHER REQUEST FOR 
DISCLOSURE OF THIS DOCUMENT OR INFORMATION CONTAINED HEREIN SHOULD BE REFERRED 
TO ICE HEADQUARTERS TOGETHER WITH A COPY OF THE DOCUMENT. 


Page 396 of 929 




OFFICIAL USE ONLY 


DEPARTMENT 

OF 

HOMELAND SECURITY 
ICE 

PAGE 5 
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REPORT OF 

I 

NVESTIGATION 


C 0 N T 

I 

N U A T I O N 

REPORT NUMBER: 044 


inv estigation in L ativa to identify the individuals i !bxs> (b>(7xc> | 

aka | (b)(B> (b)(7)(C) | . and I (b><6) (b>(7xc) | ) named in this report who have received or made 
transfers of funds from the United States representing the proceeds of the 
sale of subscriptions to member- restricted child pornography websites. It is 
respectfully requested that the ICE Attache Frankfurt coordinate with Latvian 
law enforcement officials to obtain information about the listed bank accounts 
and individuals. In addition, ICE/RAC/Birmingham requests the ICE Attache 
Frankfurt arrange a meeting with the Latvian law enforcement offici als to 
discuss the information that is being provided. Please contact SSA I (b)(6), (b)(7)(C) | 
Prevatte, ICE/RAC/Birmingham, through Sector with any questions or requests 
for additional information. 
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CASE 

NUMBER | (b)(7)(E) | 


TITLE: COMMERICAL CP WEBSITE KNOWN AS 

CASE STATUS: 


INTERIM RPT 



REPORT DATE 


DATE ASSIGNED 

PROGRAM CODE 

REPORT NO. 

102407 


072606 

m 

046 

RELATED CASE 

NUMBERS : 




COLLATERAL REQ : 


TYPE OF REPORT: 
OTHER INFORMATION 


TOPIC: SEIZURE OF $70,983.18 FROM PAYPAL 


SYNOPSIS: 

Project Flicker <Ee 3) is an ongoing joint investigation between Immigration 
and Customs Enforcement (ICE) , Resident Agent in Charge, Birmingham, Alabama 
(RAC/BI) , ICE Cyber Crimes Center (C3/CES) , the Postal Inspection Service, the 
United States Attorney's Office for the Northern District of Alabama, and 
Department of Justice/CEOS that has targeted both the principles facilitating 
subscription payments and the actual subscribers of several commercial child 
exploitation member restricted websites. The project has identified at least 
18 separate child exploitation member restricted websites and approximately 14 
principles responsible for the collection of the associated monthly 
subscription fees. 

On October 17, 2007, pursuant to Operation Flicker, Special Agents of the 
RAC/BI received four checks totaling $70,983.18 from PayPal, resulting from 
seizure warrants served on September 6, 2007. „ 
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DETAILS OF INVESTIGATION: 


Project Flicker d b is an ongoing joint investigation between Immigration 
and Customs Enforcement (ICE) , Resident Agent in Charge, Birmingham, Alabama 
{ RAC/Bi ) , ICE Cyber Crimes Center (C3/CES) , the Postal Inspection Service, the 
United States Attorney's Office for the Northern District of Alabama, and 
Department of Justice/CEOS that has targeted both the principles facilitating 
subscription payments and the actual subscribers of several commercial child 
exploitation member restricted websites. The project has identified at least 
18 separate child exploitation member restricted websites and approximately 14 
principles responsible for the collection of the associated monthly 
subscription fees. 

On October 17, 2007, pursuant to Operation Flicker, Special Agents of the 
RAC/BI received four checks totaling $70,983.18 from PayPal, resulting from 
seizure warrants served on September 6, 2007. 

Said warrants, obtained in the Northern District of Alabama commanded seizure 
based on violations listed in Title 18 USC 1960 regarding unlicensed money 
remitter laws, and unlawful activities concerning the sell and distribution of 
child pornography as listed in 18 USC 2251 and 2252. The following list of 
PayPal accounts were seized: 


NAME: 

LOCATION : 

ACCOUNT NUMBER: 

PRIMARY EMAIL NAME: 

AMMOUNT SEIZED: 

Subject of Collateral Case: 



NAME : 

LOCATION: 

ACCOUNT NUMBER: 

PRIMARY EMAIL NAME: 

AMMOUNT SEIZED: 

Subject of Collateral Case: 



NAME: 

LOCATION: 

ACCOUNT NUMBER: 

PRIMARY EMAIL NAME: 
AMMOUNT SEIZED: 

Subject of Case Number: 
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CASE NUMBER | (b)(7)(E) 

REPORT NUMBER: 046 


| (b)(6), (b)(7)(C) | 

Cary, North Carolina 

(b)(6),(b)(7)(C> 

$£, 560.66 

Case: | (b)(6) (b)(7)(C) 1 

As noted in report of investigation 002, dated October 4, 2007 of case number 
| (b)(6), (b)(7)(C), (b)(7)(E) ~| > an active duty member of the military, has been deployed 

to Iraq and therefore was not available for questioning by agents of the 
Raleigh, North Carolina office. However, all other above listed PayPal 
account holders were interviewed and were made aware of the source of funds 
traced from payments made to websites containing child pornography, and that 
these funds are subject to seizure as being proceeds from an illegal 
activity. Said funds were traced through the above listed PayPal accounts, 
above listed subject’s bank accounts, and subsequently wired to various 
locations ultimately directed to Riga, Latvia in Western Europe. 

Detailed reports of the interviews, conducted by agents of the various field 
offices, may be searched by the above corresponding case numbers. 

On October 18, 2007, a ll four chec ks totalling $70,983.18 were shipped via 
DHL, (tracking number | (b)(6), (b)(7)(C) | to Fi nes Penalties and Forfeitures in New 

Orleans, Louisiana, to the attention of \ (b>(6>,(b>(7>(c> L Seizure notice may be 

sent . 

This investigation continues. 


NAME: 

LOCATION : 

ACCOUNT NUMBER: 
PRIMARY EMAIL NAME: 
AMMOUNT SEIZED: 
Subject of Collateral 
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CASE NUMBER | (b)(7)(E) [ 

TITLE: COMMERICAL CP WEBSITE KNOWN AS Z', J 1 



CASE STATUS: 

INTERIM RPT 




REPORT DATE 

DATE ASSIGNED 

PROGRAM CODE 

REPORT NO. 

052008 

072606 

ra 

050 

RELATED CASE NUMBERS: 


COLLATERAL REQ : RACAN 


TYPE OF REPORT: 

COLLATERAL REQUEST / IN 

TOPIC: COLLATERAL REQUEST FROM RAC/BI REF. OPERATION FLICKER 


SYNOPSIS:' 

The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (D0J) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI . 

The following information pertains to a subject said to be located within the 
Anchorage, Alaska area of responsibility. The location of this subject was 
obtained from records forwarded from PayPal Inc., and through database checks. 
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REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: 050 


DETAILS OF INVESTIGATION: 


The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3), along with the United States Postal Service, Federal 
Bureau of Investigation {FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI. 

The following information pertains to a subject said to be located within the 
Anchorage, Alaska area of responsibility. The location of this subject was 
obtained from records forwarded from PayPal Inc . , and through database checks . 


SUBJECT #1 


NAME: 

DOB: 

ADDRESS : 

Other Address 
EMAIL ADDRESS: 
US PASSPORT NC 

(b)(6), (b)(7)(C) 

■ Chuaiak . AK 99567 

found : 

(b)(6), (b)(7)(C) 

, Anchorage, AK 99504 


CROSSING DATA: 09/24/2007 London 

12/25/2007 London 


Based on the interviews of approximately 14 PayPal account holders previously 
interviewed, the subjects were recruited by one of two methods. 


(b)(6) : (b)(7)(C>, (b)(7)(E) 
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Your assistance in this matter is greatly appreciated. 
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TECS ACCESS CODE | 
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CASE STATUS: 

INTERIM RPT 



REPORT DATE 

DATE ASSIGNED 

PROGRAM CODE 

REPORT NO. 

052808 

072606 

rfn 

052 

RELATED CASE NUMBERS: 

COLLATERAL REQ 

SACLA 



TYPE OF REPORT 




COLLATERAL REQUEST / IK 



TOPIC: COLLATERAL REQUEST FROM RAC/BI TO SAC/LA REF. OPERATION FLICKER 


SYNOPSIS : 


The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI. 


The following information pertains to two subjects said to be located within 
the Los Angeles, California area of responsibility. The location of these 
subjects was obtained from records forwarded from PayPal Inc. 
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REPORT NUMBER: 052 


DETAILS OF INVESTIGATION: 


The ICE office of the Resident Agent in Charge Birmingham, Alabama {RAC/BI) , 
Cyber Crimes Center (C3), along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc,, located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI. 


The following information pertains to two subjects said to be located within 
the Los Angeles, California area of responsibility. The location of these 
subjects was obtained from records forwarded from PayPal Inc., as well as 
database checks . 


SUBJECT #1 

NAME: 

DOB: 

ADDRESS : 

EMAIL ADDRESS 


Unk 


, Redondo Beach, CA 90278 


SUBJECT #2 
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(b)(5), (b)(6), (b)(7)(C), (b)(7)(E) 


Your assistance in this matter is greatly appreciated. 
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CASE STATUS: 
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RELATED CASE NUMBERS: 

COLLATERAL REQ : 
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TYPE OF REPORT: 
COLLATERAL REQUEST / IN 


- 

TOPIC! COLLATERAL REQUEST TO SAC/PX REF 

. OPERATION FLICKER 



The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI. 


The following information pertains to a subject said to be located within the 
Phoenix, Arizona area of responsibility. The location of this subject was 
obtained from records forwarded from PayPal Inc., as well database checks. 
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DETAILS OF INVESTIGATION: 

The ICE office of the Resident Agent in Charge Birmingham, Alabama {RAC/BI) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/Bi agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI. 

The following information pertains to a subject said to be located within the 
Phoenix, Arizona area of responsibility. The location of this subject was 
obtained from records forwarded from PayPal Inc., as well as through database 
checks . 


SUBJECT #1 


NAME : | (b)(6), (b)(7)(C) 

DOB: unis 

ADDRESS : I 

Other Address found : ,1 
EMAIL ADDRESS 


E , Arizona 85233 

Phnen/jx, Arizona 85004 
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CASE NUMBER 


TITLE: COMMERICAL CP WEBSITE KNOWN AS | Jg IS^jgKS.1 

CASE STATUS: 

INTERIM RPT 



REPORT DATE 
052808 

DATE ASSIGNED 
072606 


REPORT NO. 
053 

RELATED CASE NUMBERS: 

COLLATERAL REQ 

SACSD 



TYPE OF REPORT 




COLLATERAL REQUEST / IN 



TOPIC: COLLATERAL REQUEST TO SAC/SD FROM RAC/BI REF. OPERATION FLICKER 


The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3), along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI. 


The following information pertains to one subject said to be located within 
the San Diego, California area of responsibility. The location of this 
subject was obtained from records forwarded from PayPal Incorporated. 
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CONTINUATION 

REPORT NUMBER : 053 


DETAILS OF INVESTIGATION: 


The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3), along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI . 


The following information pertains to one subject said to be located within 
the San Diego, California area of responsibility. The location of this 
subject was obtained from records forwarded from PayPal Inc., as well as 
through database checks. 

SUBJECT #1 

NAME: 

DOB: 

ADDRESS : 

Other Address 
EMAIL ADDRESS 
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REPORT NO. 
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RELATED CASE NUMBERS: 

COLLATERAL REQ : SACMI 

TYPE OF REPORT 




COLLATERAL REQUEST / IN 



TOPIC: COLLATERAL REQUEST TO SAC/MI FROM RAC/BI REF. OPERATION FLICKER 


The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI. 


The following information pertains to one subject said to be located within 
the Miami, Florida area of responsibility. The location of this subject was 
obtained from records forwarded from PayPal Incorporated. 
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DETAILS OF INVESTIGATION: 

The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI . 

The following information pertains to one subject said to be located within 
the Miami, Florida area of responsibility. The location of this subject was 
obtained from records forwarded from PayPal Inc., as well as through database 
checks . 


SUBJECT #1 


NAME: 

DOB: I 

ADDRESS ; f 

OTHER ADDRES: | 
EMAIL ADDRESS: 


1 , Miami, 
Boca Raton, FL 


FL 33126 
33496 
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CASE NUMBER | (b)(7)(E) ] 

TITLE: COMMERICAL CP WEBSITE KNOWN AS HOME COLLECTION 

CASE STATUS: 

INTERIM RPT 




REPORT DATE 

DATE ASSIGNED 



REPORT NO. 

052808 
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055 





RELATED CASE NUMBERS: 


COLLATERAL REQ : RACPS 


TYPE OF REPORT: 
COLLATERAL REQUEST / IN 


TOPIC: COLLATERAL REQUEST TO RAC/PS FROM RAC/BI REF. OPERATION FLICKER 


SYNOPSIS: 

The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI . 

The following information pertains to three subjects said to be located within 
the Pensacola, Florida area of responsibility. The location of these subjects 
was obtained from records forwarded from PayPal Incorporated. 
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DETAILS OF INVESTIGATION: 

The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI . 


The following information pertains to three subjects said to be located within 
the Pensacola, Florida area of responsibility. The location of these subjects 
was obtained from records forwarded from PayPal Inc., as well as through 
database checks. 

SUBJECT #1 


NAME: 

DOB: 

ADDRES; 

EMAIL ADDRESS 

SUBJECT #2 


Defuniak Sp rings, FL 32433 


3 


NAME 
DOB: 

ADDRESS^ 

EMAIL ADDRESS: 

SUBJECT #3 


Crestview , FL 32539 


NAME: 

DOB : (b)(6), (b)(7)(C) 

addresL r 

Other Possible Address: I 
EMAIL ADDRESS : I _ (b)(G),(b)(7)(C) 
CROSSING DATA: Nassau, Bahama: 


1 Fnrf Waltf 

(b)(6), (b)(7)(C) 

□ 


3 . 


November 6 , 


Beach FL 32548 
Patrick AFB , FL 

2006 


32,925 


Based on the interviews of approximately 14 PayPal account holders previously 
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Please forward any and all information obtained 
RAC/BI address: 

Immigration and Customs Enforcement 
Office the Resident Agent in Charge 
ATTN: SSA[ (b)(6), (b)(7)(C) ] 

| (b)(6), (b)(7)(C) | 

Homewood, Alabama 35290 
Your assistance in this matter is greatly appreciated. 



from the interviews to the 
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TOPIC: COLLATERAL REQUEST TO RAC/FP FROM RAC/BI REF. OPERATION FLICKER 


SYNOPSIS: 

The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3), along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI. 


The following information pertains to one subject said to be located within 
the Fort Pierce, Florida area of responsibility. The location of this subject 
was obtained from records forwarded from PayPal Incorporated. 
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CONTINUATION 

REPORT NUMBER: 056 


DETAILS OF INVESTIGATION: 

The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOlT) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI. 

The following information pertains to one subject said to be located within 
the Fort Pierce, Florida area of responsibility. The location of this subject 
was obtained from records forwarded from PayPal Inc., as well as through 
database checks . 


SUBJECT #1 


NAME : I (b)(6). (b)(7KC> j 

DOB: 

ADDRESS ; 

Other Possible Address: 
EMAIL ADDRESS: I 


(b)(6), (b)(7)(C) 

(b)(6) (b)(7)(C) 
(b)(6), (b)(7)(C) 


Stuart, FL 34997 
, Palm City, FL 


34990 


(b)(6), (b)(7)(C), (b)(7)(E) 
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CASE STATUS: 

INTERIM RPT 



REPORT DATE 
052808 

DATE ASSIGNED 
072606 

PROGRAM CODE 
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REPORT NO. 
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RELATED CASE NUMBERS: 

COLLATERAL REQ: 

: SACCH 



TYPE OF REPORT: 




COLLATERAL REQUEST / IN 



TOPIC: COLLATERAL REQUEST TO SAC/CH FROM RAC/BI REF. OPERATION FLICKER 


SYNOPSIS: 

The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S, Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI. 


The following information pertains to one subject said to be located within 
the Chicago, Illinois area of responsibility. The location of this subject 
was obtained from records forwarded from PayPal Incorporated. 
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CASE 

NUMBER I (b)(7)(E) | 


TITLE: COMMERICAL CP WEBSITE KNOWN As BgSSS] 
CASE STATUS: INTERIM” RPT 


REPORT DATE 

DATE ASSIGNED 

PROGRAM CODE | 

REPORT NO. 
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072606 

csd 

058 


RELATED CASE NUMBERS: 


COLLATERAL REQ : RACEB 


TYPE OF REPORT: 

COLLATERAL REQUEST / IN 

TOPIC? - ^ LATERAL REQUEST^TO RACEB - FRdNr^C/Bf '^7”6^RATION "FLICKER 


SYNOPSIS : 

The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI. 

The following information pertains to one subject said to be located within 
the Boise, Idaho area of responsibility. The location of this subject was 
obtained from records forwarded from PayPal Incorporated. 
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DETAILS OF INVESTIGATION: 


The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI. 

The following information pertains to one subject said to be located within 
the Boise, Idaho area of responsibility. The location of this subject was 
obtained from records forwarded from PayPal Inc., as well as through database 
checks . 

SUBJECT #1 


NAME: 

DOB: 

ADDRESS : 

Other Possible Address : 
EMAIL ADDRESS : 


Boise, ID 83709 


H, Boise, ID 83704 
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'CASE NUMBER | (b)(7)(E) 


TITLE : COMMERICAL CP WEBSITE KNOWN AS LTS SSSISLI 

CASE STATUS: 

INTERIM RPT 



REPORT DATE 

DATE ASSIGNED 

PROGRAM CODE 

REPORT NO. 
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1 RELATED CASE NUMBERS: 

COLLATERAL REQ : 

iRACIP 




TYPE OF REPORT: 
COLLATERAL REQUEST / IN 


TOPIC: COLLATERAL REQUEST TO RAC/IP FROM RAC/BI REF. OPERATION PREDATOR 


SYNOPSIS: 

The ICE office of the Resident Agent in Charge Birmingham, Alabama {RAC/BI) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI . 


The following information pertains to one subject said to be located within 
the Indianapolis, Indiana area of responsibility. The location of this 
subject was obtained from records forwarded from PayPal Incorporated. 
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DETAILS OF INVESTIGATION: 


The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center {C3) , along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting : an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI. 

The following information pertains to one subject said to be located within 
the Indianapolis, Indiana area of responsibility. The location of this 
subject was obtained from records forwarded from PayPal Inc., as well as 
through database checks. 

SUBJECT #1 

NAME: 

DOB: 

ADDRESS : 

Other Possible Address 
EMAIL ADDRESS: 
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DEPARTMENT OF HOMELAND SECURITY 
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TITLE: COMMERICAL CP WEBSITE~KNOWN AS tff and! 
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CASE NUMBER 


ET 


CASE STATUS: 

INTERIM RPT 
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DATE ASSIGNED 

PROGRAM CODE 

REPORT NO. 
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RELATED CASE NUMBERS: 



COLLATERAL REQ : SACBA 

TYPE OF REPORT 




COLLATERAL REQUEST / IN 



TOPIC: COLLATERAL REQUEST TO SACBA FROM RAC/BI REF. OPERATION FLICKER 


The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI . 


The following information pertains to one subject said to be located within 
the Baltimore, Maryland area of responsibility. The location of this subject 
was obtained from records forwarded from PayPal Incorporated. 
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DEPARTMENT OF HOMELAND SECURITY 
ICE 


REPORT OF INVESTIGATION 
CONTINUATION 
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CASE NUMBER" ! (b)(7)(E) | 

REPORT NUMBER : 060 


DETAILS OF INVESTIGATION: 


The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney’s 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI. 


The following information pertains to one subject said to be located within 
the Baltimore, Maryland area of responsibility. The location of this subject 
was obtained from records forwarded from PayPal Inc. , as well as through 
database checks . 


SUBJECT #1 



EMAIL ADDRE, 


Mea de, MD 


20755 
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RELATED CASE NUMBERS: 

COLLATERAL REQ; 

: SACMS 



TYPE OF REPORT: 




COLLATERAL REQUEST / IN 



TOPIC: COLLATERAL REQUEST TO SAC/MS FROM RAC/BI REF. OPERATION FLICKER 


SYNOPSIS: 

The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI . 


The following information pertains to three subjects said to be located within 
the St. Paul, Minnesota area of responsibility. The location of these 
subjects was obtained from records forwarded from PayPal Incorporated. 
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DEPARTMENT OF HOMELAND SECURITY 

PAGE 3 

ICE 
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REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: 061 


DETAILS OF INVESTIGATION: 


The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center {C3), along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the trahsmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI. 

The following information pertains to three subjects said to be located within 
the St. Paul, Minnesota area of responsibility. The location of these 
subjects was obtained from records forwarded from PayPal Inc., as.,well as 
through database checks. 


SUBJECT #1 


NAME: I 

DOB: 

ADDRESS : 

Other Possible Address : 
EMAIL ADDRESS: 


Faribault, 


MN 5 5021 

I Baraboo, 


CRIMINAL HISTORY: Subject is a registered sex offender. On 07/18/2006, 

Subject was convicted of Possession of Child Pornography in Wisconsin and 
sentenced to five years. 


SUBJECT #2 
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DOB: 

ADDRESS: 

EMAIL ADDRESS: | 


(b)(6), (b)(7)(C) 


Staples, 
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MN 56479 


SUBJECT #3 


NAME: I (b)(6), (b)(7)(C) 

DOB: I 

ADDRESS : I 

EMAIL ADDRESS: 


(b)(6), (b)(7)(C) 
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I, Maple Lak e, 

(b)(6), (b)(7)(C) ~| 


MN 55358 
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TYPE OF REPORT: 
COLLATERAL REQUEST / IN 


TOPIC: COLLATERAL REQUEST TO SACDT FROM RAC/BI REF. OPERATION FLICKER 


SYNOPSIS : 

The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI. 


The following information pertains to one subject said to be located within 
the Detroit, Michigan area of responsibility. The location of this subject 
was obtained from records forwarded from PayPal Incorporated. 
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REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: 062 


DETAILS OF INVESTIGATION: 


The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI. 

The following information pertains to one subject said to be located within 
the Detroit, Michigan area of responsibility. The location of this subject 
was obtained from records forwarded from PayPal Inc., as well as through 
database checks . 


SUBJECT #1 


NAME: 

DOB: 

ADDRESS : 

EMAIL ADDRESS 




Wyandotte , MI 


48192 
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RELATED CASE NUMBERS: 

COLLATERAL REQ 

RACGF 



TYPE OF REPORT: 



COLLATERAL REQUEST / IN 



TOPIC: COLLATERAL REQUEST TO RAC/GF FROM RAC/BI REF. OPERATION FLICKER 


SYNOPSIS : 

The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI. 


The following information pertains to one subject said to be located within 
the Great Falls, Montana area of responsibility. The location of this subject 
was obtained from records forwarded from PayPal Incorporated. 
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CASE NUMBER | (b)(7)(E)" | 

REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: 063 


DETAILS OF INVESTIGATION: 


The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI. 

The following information pertains to one subject said to be located within 
the Great Falls, Montana area of responsibility. The location of this subject 
was obtained from records forwarded from PayPal Inc., as well as through 
database checks . 


SUBJECT #1 


NAME: 

DOB: 


foWKC) 


=L 


(b)(6), (b)(7)(C) 


ADDRESS : 

Other Possible Address. 

EMAIL ADDRESS: [_ 

TECS CHECKS: Subject is a registered pilot with the FAA 


, Geraldine, MT 59446 

I (b)(G> (b)(7)(C) | . Geraldine, MT 59446 

(b)(6), (b)(7)(C) I 


(b)(5), (b)(6), (b)(7)(C), (b)(7)(E) 
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REQUESTED BY: 



TOPIC: COLLATERAL REQUEST TO SAC/NK FROM RAC/BI~REF. OPERATION FLICKER 


SYNOPSIS: 

The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3), along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI. 


The following information pertains to one subject said to be located within 
the Newark, New Jersey area of responsibility. The location of this subject 
was obtained from records forwarded from PayPal Incorporated. 
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CASE NUMBER | (b)(7)(E) ' | 

_ RE PORT "NUMBER: 064 


DETAILS OF INVESTIGATION: 


The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI . 


The following information pertains to one subject said to be located within 
the Newark, New Jersey area of responsibility. The location of this subject 
was obtained from records forwarded from PayPal Inc., as well as through 
database checks. 


SUBJECT #1 


_|, Wayne, NJ 07470 
JTwayne, NJ 07470 


NAME: 

DOB : (b)(6), (b)(7)(C) 

ADDRESS : 

Other Possible Address: (b)(6), (b)(7)(C) 

EMAIL ADDRESS: (b)(6), (b)(7)(C) 

CRIMINAL HISTORY; Subject is a registered sex offender. On 11/08/1985, 
Subject was convicted of sexual assault and sentenced to ten years. On 
4/26/2004, Subject was convicted for endangering the welfare of a child and 
sentenced to three years probation. 
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TECS ACCESS CpDE^ 


CASE NUMBER E 


TITLE: COMMERICAL CP WEBSITE KNOWN AS HOME COLLECTION 

CASE STATUS: 

INTERIM RPT 



REPORT DATE 

DATE ASSIGNED 

PROGRAM CODE 

REPORT NO. 

052808 

072606 


065 

RELATED CASE NUMBERS: 

COLLATERAL REQ : 

i SACNY 



TYPE OF REPORT: 




COLLATERAL REQUEST / IN 



TOPIC: COLLATERAL REQUEST TO SAC/NY FROM RAC/BI REF. OPERATION FLICKER 


SYNOPSIS: 

The ICE office of the Resident Agent in Charge Birmingham, Alabaiha (RAC/BI) , 
Cyber Crimes Center (C3), along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI . 


The following information pertains to two subjects said to be located within 
the New York, NY area of responsibility. The location of these subjects was 
obtained from records forwarded from PayPal Incorporated. 


DISTRIBUTION: 

SIGNATURE: 

1 (b)(7)(E) | 
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| (b)(6), (b)(7)(C) | oi GRP SUPERVISOR 
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CONTINUATION 

REPORT NUMBER: 065 

DETAILS OF INVESTIGATION: 


The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI. 

The following information pertains to two subjects said to be located within 
the New York, NY area of responsibility. The location of these subjects was 
obtained from records forwarded from PayPal Inc., as well as through database 
checks . 

SUBJECT #1 


NY 10709 


SUBJECT #2 


Brooklyn, NY 11209 
Brooklyn, NY 11221 
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NAME: 

DOB: 

ADDRESS : 1 

Other Address :[ 
EMAIL ADDRESS: 



NAME: 

DOB: 

ADDRESS : 

EMAIL ADDRESS 


(b)(6), (b)(7)(C) 

. Eastchester, 

\ 
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PAGE 1 


CASE NUMBER BI07QR06KS0160 


TITLE: COMMERICAL CP WEBSITE KNOWN AS HOME COLLECTION 


CASE STATUS: 

INTERIM RPT 



REPORT DATE 

DATE ASSIGNED 

PROGRAM CODE 

REPORT NO. 

052808 

072606 


a 066 

RELATED CASE NUMBERS: j 


COLLATERAL REQ : SACNO 


TYPE OF REPORT: 
COLLATERAL REQUEST / IN 


TOPIC: COLLATERAL REQUEST TO SACNO FROM RAC/BI REF. OPERATION FLICKER 


SYNOPSIS: 

The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, Federal 
Bureau of Investigation {FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI . n 


The following information pertains to one subject said to be located within 
the New Orleans, Louisiana area of responsibility. The location of this 
subject was obtained from records forwarded from PayPal Inc. 


DISTRIBUTION: 

SIGNATURE: 

(b)(7)(E) | 

| (b)(6), (b)(7)(C) | SPECIAL AGENT 



APPROVED : 

| (b)(6), (b)(7)(C) | OI GRP SUPERVISOR 

ORIGIN OFFICE: BI 
BIRMINGHAM, AL - RAC 

TELEPHONE: 205 73l 1 

TYPIST :V" x W ,,, r 


OFFICIAL USE ONLY 


THIS DOCUMENT IS LOANED TO YOU FOR OFFICIAL USE ONLY AND REMAINS THE PROPERTY 
OF THE DEPARTMENT OF HOMELAND SECURITY, ICE. ANY FURTHER REQUEST FOR 
DISCLOSURE OF THIS DOCUMENT OR INFORMATION CONTAINED HEREIN SHOULD BE REFERRED 
TO ICE HEADQUARTERS TOGETHER WITH A COPY OF THE DOCUMENT. 


Page 469 of 929 





OFFICIAL USE ONLY 



OFFICIAL USE ONLY 


THIS DOCUMENT IS LOANED TO YOU FOR OFFICIAL USE ONLY AND REMAINS THE PROPERTY 
OF THE DEPARTMENT OF HOMELAND SECURITY, ICE. ANY FURTHER REQUEST FOR 
DISCLOSURE OF THIS DOCUMENT OR INFORMATION CONTAINED HEREIN SHOULD BE REFERRED 
TO ICE HEADQUARTERS TOGETHER WITH A COPY OF THE DOCUMENT. 


Page 470 of 929 






OFFICIAL USE ONLY 


DEPARTMENT OF HOMELAND SECURITY 
ICE 

PAGE 3 

REPORT OF INVESTIGATION 

CASE NUMBER 1 (b)(7)(E) | 

CONTINUATION 

REPORT NUMBER: 066 


DETAILS OF INVESTIGATION: 


The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI . 

The following information pertains to one subject said to be located within 
the New Orleans, Louisiana area of responsibility. The location of this 
subject was obtained from records forwarded from PayPal Inc., as well as 
through database checks. 

SUBJECT #1 

NAME : | (b)(6), (b)(7)(C) 1 

! (b)(6), (b)(7)(C) 

ADDRESS : I. New Or leans. Louisiana 70127 

EMAIL ADDRESS : | (b)(6), (b)(7)(C) | 
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REQUESTED BY: 




SYNOPSIS: 

The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI . 


The following information pertains to one subject said to be located within 
the Cincinnati, Ohio area of responsibility. The location of this subject was 
obtained from records forwarded from PayPal Incorporated. 
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CASE NUMBER | (b)(7)(E) ] 

REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: 067 


DETAILS OF INVESTIGATION: 


The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI. 

The following information pertains to one subject said to be located within 
the Cincinnati, Ohio area of responsibility. The location of this subject was 
obtained from records forwarded from PayPal Inc., as well as through database 
checks . 

SUBJECT #1 


NAME: 

DOB: 

ADDRESS : 

Other Address: l 
EMAIL ADDRESS : | 


(b)(6),(b)(7)(C).(b)(7)(E) 


Cincinnati, OH 45224 
J, West Chester OH 45069 
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CASE NUMBER [_ 
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ST 


witnesses rights. 


CASE STATUS: 

INTERIM RPT 



REPORT DATE 
052808 

DATE ASSIGNED 
072606 

PROGRAM CODE 

rfi 

REPORT NO. 
068 

RELATED CASE NUMBERS: 

COLLATERAL REQ 

RACLV 




TYPE OF REPORT: 
COLLATERAL REQUEST / IN 


TOPIC: COLLATERAL REQUEST TO RACLV FROM RAC/BI REF. OPERATION FLICKER 


SYNOPSIS: 

The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney’s 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI . 


The following information pertains to one subject said to be located within 
the Las Vegas, Nevada area of responsibility. The location of this subject 
was obtained from records forwarded from PayPal Incorporated. 


DISTRIBUTION: 

SIGNATURE: » 
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| (b)(6), (b)(7)(C) | SPECIAL AGENT 

APPROVED : 
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CASE 

NUMBER | 
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REPORT NUMBER: 068 


DETAILS OF INVESTIGATION: 


The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section {CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI. 

The following information pertains to one subject said to be located within 
the Las Vegas, Nevada area of responsibility. The location of this subject 
was obtained from records forwarded from PayPal Inc., as well as through 
database checks. 


SUBJECT ttl 


NAME : I g‘)(6).(b)j. 'ip:) | 

DOB; unk. 

ADDRESS: I (W) (b)(7)(C) |, North Las Vec as. NV 8 9032 

EMAIL ADDRESS: | (b> ( s> ( b>(7>(c> | 


(b)(8), (b)(7)(C), (b)(7)(E) 


OFFICIAL USE ONLY 

THIS DOCUMENT IS LOANED TO YOU FOR OFFICIAL USE ONLY AND REMAINS THE PROPERTY 
OF THE DEPARTMENT OF HOMELAND SECURITY, ICE. ANY FURTHER REQUEST FOR 
DISCLOSURE OF THIS DOCUMENT OR INFORMATION CONTAINED HEREIN SHOULD BE REFERRED 
TO ICE HEADQUARTERS TOGETHER WITH A COPY OF THE DOCUMENT. 


Page 479 of 929 





OFFICIAL USE ONLY 



OFFICIAL USE ONLY 

THIS DOCUMENT IS LOANED TO YOU FOR OFFICIAL USE ONLY AND REMAINS THE PROPERTY 
OF THE DEPARTMENT OF HOMELAND SECURITY, ICE. ANY FURTHER REQUEST FOR 
DISCLOSURE OF THIS DOCUMENT OR INFORMATION CONTAINED HEREIN SHOULD BE REFERRED 
TO ICE HEADQUARTERS TOGETHER WITH A COPY OF THE DOCUMENT. 


Page 480 of 929 





(b)(6), (b)(7)(C) | 

OFFICIAL USE ONLY 
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DEPARTMENT OF HOMELAND SECURITY 
ICE 


REPORT OF INVESTIGATION 


TECS ACCESS CODE 


CASE NUMBER [] 


TITLE: COMMERICAL CP WEBSITE KNOWN AS | 1 

CASE STATUS: 

INTERIM RPT 



REPORT DATE 

DATE ASSIGNED 

PROGRAM CODE 

REPORT NO. 

052808 

072606 

YT1 

069 

RELATED CASE NUMBERS: 

COLLATERAL REQ 

RACOM 



TYPE OF REPORT: 



COLLATERAL REQUEST / IN 



TOPIC: COLLATERAL REQUEST TO RAC/OM FROM RAC/BI REF. OPERATION FLICKER 


SYNOPSIS: 

The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States*Attorney 1 s 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI . 


The following information pertains to one subject said to be located within 
the Medford, Oregon area of responsibility. The location of this subject was 
obtained from records forwarded from PayPal Incorporated. 


DISTRIBUTION: 
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APPROVED : 
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ORIGIN OFFICE: BI 
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TELEPHONE: 205 23 1 

TYPIST: 1 (b)(6), (b)(7)(C) I 
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DEPARTMENT OF HOMELAND SECURITY 

PAGE 3 
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CASE NUMBER | (b)(7)(E) T 

REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER.s 06 9 


DETAILS OF INVESTIGATION: 


The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, Federal 
Bureau of Investigation {FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI. 

The following information pertains to one subject said to be located within 
the Medford, Oregon area of responsibility. The location of this subject was 
obtained from records forwarded from PayPal Inc., as well as through database 
checks . 


SUBJECT #1 


NAME : I (b)(6) (b) 

DOB: 

ADDRESS : 

EMAIL ADDRESS 


□ 

(b)(6), (b)(7)(C) 


Eugene . 

(b)(6), (b)(7)(C) 


QR 97491 
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CASE NUMBER 1 (b)(7)(E) | 

TITLE: COMMERICAL CP WEBSITE KNOWN AS |,^mr ; '.“nrt rh 


CASE STATUS: 

INTERIM RPT 




REPORT DATE 

DATE ASSIGNED 

PROGRAM, CODE 

REPORT NO. 

052908 

072606 

rfn 

070 

RELATED CASE NUMBERS: 

COLLATERAL REQ : RACPF 

TYPE OF REPORT 





COLLATERAL REQUEST / IN 





TOPIC: COLLATERAL REQUEST TO RAC/PF FROM RAC/BI REF. OPERATION FLICKER 


“SYNOPSIS : 

The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI . 

The following information pertains to one subject said to be located within 
the Providence, Rhode Island area of responsibility. The location of this 
subject was obtained from records forwarded from PayPal Incorporated. 


DISTRIBUTION: 

(b)(7)(E) 


SIGNATURE: 

(b)(6) (b)(7)(C) 


APPROVED ; 

(b)(6). (b)(7)(C) 


SPECIAL AGENT 


01 GRP SUPERVISOR 



ORIGIN OFFICE: BI 
BIRMINGHAM, AL - RAC 

TELEPHONE: 205 2 % w™™'' | 



TYPIST: | (b)(3), (b)(7)(C) | 


OFFICIAL USE ONLY 


THIS DOCUMENT IS LOANED TO YOU FOR OFFICIAL USE ONLY AND REMAINS THE PROPERTY 
OF THE DEPARTMENT OF HOMELAND SECURITY, ICE. ANY FURTHER REQUEST FOR 
DISCLOSURE OF THIS DOCUMENT OR INFORMATION CONTAINED HEREIN SHOULD BE REFERRED 
TO ICE HEADQUARTERS TOGETHER WITH A COPY OF THE DOCUMENT. 


Page 485 of 929 












OFFICIAL USE ONLY 

DEPARTMENT OF HOMELAND SECURITY 
ICE 

REPORT OF INVESTIGATION 
CONTINUATION 


CASE PROGRAM CODES: 


(b)(7)(E) 



OFFICIAL USE ONLY 


THIS DOCUMENT IS LOANED TO YOU FOR OFFICIAL USE ONLY AND REMAINS THE PROPERTY 
OF THE DEPARTMENT OF HOMELAND SECURITY, ICE. ANY FURTHER REQUEST FOR 
DISCLOSURE OF THIS DOCUMENT OR INFORMATION CONTAINED HEREIN SHOULD BE REFERRED 
TO ICE HEADQUARTERS TOGETHER WITH A COPY OF THE DOCUMENT. 



Page 486 of 929 






OFFICIAL USE ONLY 


DEPARTMENT OF HOMELAND SECURITY 
ICE 


REPORT OF INVESTIGATION 
CONTINUATION 


PAGE 3 

CASE NUMBER I (b)(7)(E) | ' 

REPORT NUMBER: 070 


DETAILS OF INVESTIGATION: 


The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting 1 an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc,, located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI . 

The following information pertains to one subject said to be located within 
the Providence, Rhode Island area of responsibility. The location of this 
subject was obtained from records forwarded from PayPal Incorporated. 

SUBJECT #1 

NAME : | (b)(6), (b)(7)(C) | 

DOB; 

ADDRESS : 

EMAIL ADDRESS: 


unknown 

I (b)(6), (b)(7)(C) 


(b)(6), (b)(7)(C), (b)(7)(E) 


OFFICIAL USE ONLY 

THIS DOCUMENT IS LOANED TO YOU FOR OFFICIAL USE ONLY AND REMAINS THE PROPERTY 
OF THE DEPARTMENT OF HOMELAND SECURITY, ICE. ANY FURTHER REQUEST FOR 
DISCLOSURE OF THIS DOCUMENT OR INFORMATION CONTAINED HEREIN SHOULD BE REFERRED 
TO ICE HEADQUARTERS TOGETHER WITH A COPY OF THE DOCUMENT. 


Page 487 of 929 







OFFICIAL USE ONLY 


DEPARTMENT OF HOMELAND SECURITY 

PAGE 4 

ICE 



CASE NUMBER 1 (b)(7)(E) | 

REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: 070 


(b)(5), (b)(6), (b)(7)(C>, (b)(7)(E) 


Your assistance in this matter is greatly appreciated. 
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COLLATERAL REQ 
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TYPE OF REPORT 




COLLATERAL REQUEST / IN 



TOPIC: COLLATERAL REQUEST TO ASC/NF FROM RAC/BI REF OPERATION FLICKER 


SYNOPSIS: 

The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, 

Federal Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , 
Child Exploitation and Obscenity Section (CEOS) , and the United States 
Attorneys Office (USAO) for the Northern District of Alabama are conducting 
an investigation in reference to Operation Flicker regarding the transmittal 
of monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with 
PayPal Inc., located in San Jose, California. PayPal account holders 
identified as being processors for the member restricted child pornography 
websites have been forwarded to the RAC/BI. 


The following information pertains to one subject said to be located within 
the Norfolk, VA area of responsibility. The location of this subject was 
obtained from records forwarded from PayPal Incorporated. 
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DETAILS OF INVESTIGATION: 


The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI ) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, 

Federal Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , 
Child Exploitation and Obscenity Section (CEOS) , and the United States 
Attorneys Office (USAO) for the Northern District of Alabama are conducting 
an investigation in reference to Operation Flicker regarding the transmittal 
of monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with 
PayPal Inc., located in San Jose, California. PayPal account holders 
identified as being processors for the member restricted child pornography 
websites have been forwarded to the RAC/BI. 


The following information pertains to one subject said to be located within 
the Norfolk, VA area of responsibility. The location of this subject was 
obtained from records forwarded from PayPal Inc., as well as through database 
checks . 


SUBJECT #1 


NAME 
DOB: 

ADDRESS: I (b>(B> (b)(7)(C) | , Chesterfield, VA 23832 

EMAIL ADDRESS: | (b)(6), (b)(7)(C) | 

SUBJECT #2 


(b)(6), (b)(7)(C) 
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CASE STATUS: 

INTERIM RPT 
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COLLATERAL REQ 

RACGV 



TYPE OF REPORT 




COLLATERAL REQUEST / IN 



TOPIC: COLLATERAL REQUEST TO RAC/GV FROM RAC/BI REF. OPERATION FLICKER 


SYNOPSIS : 

The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI . 


The following information pertains to two subjects said to be located within 
the Greenville, South Carolina area of responsibility. The location of these 
subjects was obtained from records forwarded from PayPal Incorporated. 
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DETAILS OF INVESTIGATION: 


The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3), along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOj) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships, As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI . 

The following information pertains to two subjects said to be located within 
the Greenville, South Carolina area of responsibility. The location of these 
subjects was obtained from records forwarded from PayPal Inc., as well as 
through database checks. 


SUBJECT #1 


NAME: | 

DOB: 

ADDRESS : 

EMAIL ADDRESS: 


(b)(6), (b)(7)(C) 
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(b)(6) (b)(7)(C) 


Easl ey, SC 


SUBJEC T #2 
NAME: I 

DOB: 

ADDRESS : 

EMAIL ADDRESS: 
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Easle y, SC 29642 
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TITLE: OOMMERTOAL CP WEBSTTF. KNOWN AS 1(b)(3): 18 U.S.C. § 3509(d) Child vi| 

CASE STATUS: 
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DATE ASSIGNED 

PROGRAM CODE 

REPORT NO. 
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RELATED CASE NUMBERS: 

COLLATERAL REQ 

SACSA 



TYPE OF REPORT 




COLLATERAL REQUEST / IN 



TOPIC: COLLATERAL REQUEST TO SACSA FROM 

RAC/BI REF. OPERATION FLICKER 


SYNOPSIS : 

The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center <C3) , along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI. These processors are located throughout the 
United States and are of interest to the United States Attorney's office for 
the Northern District of Alabama. The following information pertains to two 
subjects said to be located within the San Antonio, Texas area of 
responsibility . 
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DETAILS OF INVESTIGATION: ■? 

The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3), along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI . These processors are located throughout the 
United States and are of interest to the United States Attorney's office for 
the Northern District of Alabama. 

The following information pertains to two subjects said to be located within 
the San Antonio, Texas area of responsibility. The location of these subjects 
was obtained from records forwarded from PayPal Inc., as well as through 
database checks . 


SUBJECT #1 


DOB: 

ADDRESS : 

(b)(6), (b)(7)(C) 

I W ni 

Other Possible 

Address: | 
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EMAIL ADDRESS 


| (b)(6), (b)(7)(C) | 


o, Texas 78223 

San Antonio, Texas 78264 


SUBJEC T U 2 

NAME : I (b)(6) (b)(/~ 
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(b)(G) (b)(7)(C) | 


TX 78210 
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Your assistance in this matter is greatly appreciated. 
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TOPIC: COLLATERAL REQUEST TO RAC/YA FROM RAC/BI REF. OPERATION FLICKER 


SYNOPSIS: 

The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3), along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjuncti6n with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI . These processors are located throughout the 
United States and are of interest to the United States Attorney's office for 
the Northern District of Alabama. 


The following information pertains to one subject said to be located within 
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CASE 

NUMBER 1 
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REPORT NUMBER: 074 


the Yakima, Washington area of responsibility. The location of this subject 
was obtained from records forwarded from PayPal Inc., as well as through 
database checks . 


DETAILS OF INVESTIGATION: 

The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3), along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI. These processors are located throughout the 
United States and are of interest to the United States Attorney's office for 
the Northern District of Alabama. 

The following information pertains to one subject said to be located within 
the Yakima, Washington area of responsibility. The location of t^is subject 
was obtained from records forwarded from PayPal Inc . , as w ell as through 
database checks. Please note subjects FBI record number. I (b>(6> (b)(7>(c> ] has 

been involved in numerous DUI arrests, as well as an escape charge. 

SUBJECT #1 


NAME: 



DOB: 

(b)(6), (b)(7)(C) 


ADDRESS : 


, Yakima, WA 98901 

EMAIL ADDRESS : j 

(b)(6).(b)(7)(C) | 

FBI#: 

numerous 

DUI arrests. Giving False Information, 

Possession of Marijuana, Escape charges. 
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Your assistance in this matter is greatly appreciated. 
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TECS ACCESS CODE 


CASE NUMBER I 


TITLE: COMMERICAL CP WEBSITE KNOWN AS 1(b)(3) :i 8 u.s.c. § 3509(d> Child vi| 

CASE STATUS: 

INTERIM RPT 



REPORT DATE 

DATE ASSIGNED 

PROGRAM CODE 

REPORT NO. 

052908 

072606 

ra 

075 

| RELATED CASE NUMBERS: j 

COLLATERAL REQ ; 

: SACBO 



TYPE OF REPORT: 



COLLATERAL REQUEST / IN 



TOPIC: COLLATERAL REQUEST TO SAC/BO FROM RAC/BI REF. OPERATION FLICKER 


SYNOPSIS: 

The ICE office of the Resident Agent in Charge Birmingham, Alabama {RAC/BI) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, Federal 
Bureau of Investigation {FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States '“Attorney 1 s 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI. 


The following information pertains to one subject said to be located within 
the Boston, Massachusetts area of responsibility. The location of the subject 
was obtained from records forwarded from PayPal Incorporated. 


DISTRIBUTION: 


| (b)(7)(E) | 

| (b)(6>,(b)(7)(C> | SPECIAL AGENT 


APPROVED : 

| (b)(6). (b)(7)(C) | OT GRP SUPERVISOR 

ORIGIN OFFICE: BI 
BIRMINGHAM, AL - RAC 

TELEPHONE: 205 29' u '7A u '''i 

TYPIST : |' l WW1^|ttE 
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DETAILS OF INVESTIGATION: 


The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI ) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI . 


The following information pertains to one subject said to be located within 
the Boston, Massachusetts area of responsibility. The location of the subject 
was obtained from records forwarded from PayPal Incorporated. 


SUBJECT #1 


NAME: 

DOB: 

ADDRESS : 

EMAIL ADDRESS 


(b)(6), (b)(7)(C) 


(b)(6), (b)(7)(C) 


Fall River, MA 02720 
Fall River, MA 02720 


(b)(6), (b)(7)(C), (b)(7)(E) 
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(b)(5), (b)(6), (b)(7)(C), (b)(7)(E) 


Your assistance in this matter is greatly appreciated. 
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CASE STATUS: 

INTERIM RPT 




REPORT DATE 
052908 

DATE ASSIGNED 
072606 

PRC 

iVi -U 

REPORT NO. 
076 

J RELATED CASE NUMBERS: 

COLLATERAL REQ: 

: SACDA 



• 

TYPE OF REPORT: 





COLLATERAL REQUEST / IN 





TOPIC: COLLATERAL REQUEST TO SACDA FROM RAC/BI REF. OPERATION FLICKER 


SYNOPSIS: 

The ICE office of the Resident Agent in Charge Birmingham, Alabama {RAC/BI ) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI. These processors are located throughout the 
United States and are of interest to the United States Attorney's office for 
the Northern District of Alabama. The following information pertains to one 
subject said to be located within the Dallas, Texas area of responsibility. 




| (b)(7)(E) j 


1 SPECIAL AGENT 



APPROVED: 


| (b)(6), (b)(7)(C) 

| OI GRP SUPERVISOR 




ORIGIN OFFICE: BI 

TELEPHONE: 205 73L_1llL1J 


BIRMINGHAM, AL - RAC 




TYPIST: 
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DETAILS OF INVESTIGATION: 

The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI ) , 
Cyber Crimes Center (C3), along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS) , and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been f orwarded to the RAC/BI . These processors are located throughout the 
United States and are of interest to the United States Attorney's office for 
the Northern District of Alabama. 

The following information pertains to one subject said to be located within 
the Dallas, Texas area of responsibility. The location of this subject was 
obtained from records forwarded from PayPal Inc., as well as through database 
checks . 

SUBJECT #1 

NAME : | (b)(6), (b)(7)(C) | 

DOB: link 

ADDRESS : | (b)(6), (b)(7)(C) |. Fort Worth. TX 76116 

Other Possible Addre ss I ^^^^ibK6Mb)(7)(c> I . Fort Worth, TX 76135 

EMAIL ADDRESS: | (bK6HbK7KC^^^^^^ 


(b)(6), (b)(7)(C). (b)(7)(E) 
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(b)(5), (b)(6), (b)(7)(C>,(b)(7>(E> 


Your assistance in this matter is greatly appreciated. 
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REPORT DATE 
052903 

DATE ASSIGNED 
072606 
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RELATED CASE NUMBERS: 

| COLLATERAL REQ : 

; RACSP 



TYPE OF REPORT: 



COLLATERAL REQUEST / IN 



TOPIC: COLLATERAL REQUEST TO RAC/SP FROM RAC/BI REF. OPERATION FLICKER 


SYNOPSIS : 

The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI. These processors are located throughout the 
United States and are of interest to the United States Attorney's office for 
the Northern District of Alabama. 

The following information pertains to one subject said to be located within 
the Spokane, Washington area of responsibility. 


DISTRIBUTION: 

SIGNATURE: 
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DETAILS OF INVESTIGATION: 

The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI. These processors are located throughout the 
United States and are of interest to the United States Attorney's office for 
the Northern District of Alabama. 

The following information pertains to one subject said to be located within 
the Spokane, Washington area of responsibility. The location of this subject 
was obtained from records forwarded from PayPal Inc., as w ell as through 
database checks. Please note subjects FBI record number. I (b)(6), (b)(7)(c) | p f 

Mead, Washington, was been arrested for Child Molestation in November of 1990 
by Spokane Sheriff's Office. 

SUBJECT #1 

NAME: | (b)(6), ( 

DOB: 

ADDRESS : 

EMAIL ADDRESS : I |b > (B > tb > (7 > (C > | 

FBI#: |ww:ww«wwu)| child Molestation in November of 1990 by Spokane, WA 

Sherriff's Office. 


Mead, WA 99021 


(b)(6), (b)(7)(C). (b)(7)(E) 
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Your assistance in this matter is greatly appreciated. 
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TITLE: COMMERICAL CP WEBSITE KNOWN AS |(b)(3)i8 use § 3509(d) Ch,idv,| 


CASE STATUS: INTERIM RPT 
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DATE ASSIGNED 

PROGRAM CODE i 

REPORT NO. 

061608 

072606 

ra 

078 


RELATED CASE NUMBERS: 


COLLATERAL REQ : 


TYPE OF REPORT: 
OTHER INFORMATION 


TOPIC: INFORMATION REGARDING KEN SLATER 


SYNOPSIS: 

The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships . 

In May 2008, ICE agents provided information regarding a subject known as Ken 
SLATER to the Child Exploitation and Online Protection Center (CEOP) located 
in London, UK. Information coll ected d uring the course of this investigation 
has lead agents to believe that | ( b >(s>w(/) | ma y be res iding j_ n London: 


DISTRIBUTION: 


1 (b)(7)(E) | 

| | SPECIAL AGENT 



APPROVED: 

| (b)(6), (b)(7)(C) | 01 GRP SUPERVISOR 

ORIGIN OFFICE: BI 
BIRMINGHAM, AL - RAC 

TELEPHONE: 205 2 9| 1 

TYPIST: 1 (b)(B>, (b)(7)(C) | 
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CONTINUATION 

REPORT NUMBER: 078 


DETAILS OF INVESTIGATION: 


The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc., located in San Jose, California. PayPal account holders identified as 
being processors for the member restricted child pornography websites have 
been forwarded to the RAC/BI. 

In May 2008 . ICE agents provided information regarding a subject known as l^nycl 
|(b)(6), (b)(7)(C)| to the Child Exploitation and Online Protection Center (CEOP) located 
in London, UK. Information col lected d uring the course of this investigation 
has lead agents to believe that I W1 7A UM " I may be residing in London. 

Beginning in February of 2006, ICE agents have identified and interviewed 
numerous individuals who have acted as processors for memberships to websites 
offering hundreds and thousand of images of child pornography. The identified 
subjects have processed payments from these websites through Pa yPal accoun ts, 
which were created to the specifications of an individual named I (b>(6> (b)(7)(c) | , 

I I , recruited t hese in dividuals from resumes posted on Monster.com and 

Careerbuilder.com. I W1 7 r .\ u » ,) | instructed the PayPal account holders to set up the 
account as a business account and were given a specific email address to 
designate as the primary email account for the PayPal profile. 

PayPal account holders also designated one, or two bank accounts as primary 
bank accounts for the purposes of transferring payments processed from the 
website memberships to their own personal bank accounts. The bank accounts 
were no t set up as business accounts, but rather personal checking accounts. 
j (b)(uub)(/) j a n owe< j each processor to maintain a certain percentage of the payments 
processed as a payment. This fee was between 5 and 10 percent. Once the 
payment s were transferred from the PayPal accounts to the bank accounts, 

| | instructed the processors to wire transfer the payments to a specific 

location. 

I wyw | instruct the processors to wire transfer the payments from their 

personal checking accounts to a location in Connecticut known at the time as 
CAPITAL COLLECT, LLC . Account holders wire transferred the payments to: 

Account Number: I (b)(6), (b)(7)(C) | 

Account Name: Capital Collect Services LLC 
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Bank Name ; Bank of A merica 
Bank SWIFT: | (b>{6>,(b>(7>(c [ 


Bank Addre ss : 461 Monroe Turnpike, Monroe, CT 064 68. USA A BA/Routing # 

| (b)(6), (b)(7)(c) | {f or ACH/Direct deposit) ABA/Routing #: | (b)(6), (b)(7)(c) | (for wire 
transfers only) Company name Capital Collect Services, LLC Company Address: 
2S05 Main Street, Suite 231 . Stratfo rd. CT 06615, USA 
Payment details: Credit ID | (b)(6), wgxc [ 


Based on search warrants obtained for email accounts, I kLJn 7,A UA '' I would instruct 
the PayPa l process ors to wire their payments to CAPITAL COLLECT, LLC to Credit 
ID number I (b)(6), (b)(7)(C)! and to expect a telephone call from a CAPITAL COLLECT 
representative to confirm the first payment was posted and received. 


It should be noted that only a portion of the PayPal account holders 
transferred the payments to this location. 

During the interview of one Pay Pal processor, I (b)(6) (b)(7)(C) | . on July 

23, 2007, suggested that I I spoke with a Europea n accent and that he stated 
numero us occasions that he lived in London. I [,> I had been in contact with 
(b)(6), (b)(7) from April of 2006 w hen she began processing until April of 2007. 

< c > continued to contact I | through her email account after agents 

interviewed her, attempting to solicit her into continuing her employment with 
him. 


Towards the end of her employment with he instru cted to send visa 

reload cards to an individual located in Russia. 1 I mailed, via United 
States Postal Service, one visa reload card to: 

| (b)(G) (b)(7)(C) | 

Ruskobank 

| (b)(6) (b)(7)(C) ~| 

St. Petersburg, Russia 

I '“"T 1 ' 1 1 agreed to coop erate w it h agent s in an attempt to further locate and 
gather information on 1 | . | | wa s provide d with the proper equipment 

to reco rd any telephone conversations with [ TO 7r7' /) l . On September 1 9 , 2 007 , 

| www''' | was successful in recording one telephone conversation witn F ST 7A° M/> I . 
This tape recording is maintai ned as electronic evidence within the RAC|BI ib)i;) 

evidence storage room. I | also c ooperate d in numerous emails with I to 1 

and ultimately introduced an agent to via email. 


During I wthe) | correspondence RAC/BI agents conducted with 

I (b)(6) (b)(7)(C) | insisted that the o nly poss ible way to continue workin g with 

him was to open a PayPal account. I wwiwu? | also asked for an address. 1 | 
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Information listed on the bottom of the application form which each PayPal 
processor was required to complete stated the following: 


"Represented by 

Mr. 1 (b)(6), (b)(7)(C) 1 

, Chief Recruiting 

Manager (HR Department) 

Registered at: 1 

| (b)(6), (b)(7)(C) | 

. London. UK. 1(b)(6), (b)(7)(C) |. Tel.: (TEL/FAX) 

(b)(6), (b)(7)(C) 

|; E-Mail: \ 

(b)(6), (b)(7)(C) I 

additional fax number: 

(b)(6), (b)(7)(C) | » . 





Agents of C3 and ICE Atta ch London determined that the address listed at 
[ (b)(6), (b)(7)(C) | , London, UK, | (b)(6>,(b)(7)(C) | was a vacant building. 

Both fax numbers are as of this date out of service, but at one time were 
serviced by a company based in Los Angeles, California called J2 Global 
Communications. Representatives from this company were very cooperative and 
provided information on both accounts. The fax numbers are virtual in nature 
meaning that the sender's documents are not actually received by a physical 
fax machine, but rather an email account designated by Slater. Search 
warrants were obtained for these email accounts. 

Fax number | (b>(B) (b)(7)(C) | listed in the name of j wis) (b)(7)(C) | of Roslyn, New York . 
Bank records belonging to the credit card charged are in the name of 1(b)(6), (b)(7)(C)] 
SIMMS of 12 Junard Drive, Roslyn, New York. Records confirm the charge made 
payable to J2 Global. 

Fax number I (b>(G> (b)(7)(c) | listed in the name of I (b)(6), (b)(7)(C) 1 of | (b)(6) (b)(7)(c) | 

Crystal lake, IL 60014. Bank records belonging to | 1P?lb , ? r: 1 ° )1/) | confirm the 
charge of made payable to J2 Global . The accounts were not renewed according 
to representatives at J2 Global . 

Other locations | instructed the processors to wire transfer payments to 

were as follows: 

| (b)(6) (b)(7)(C) | 

Ruskobank 

| ^ (b)(6) (b)(7)(C) ~~| 

St. Petersburg, Russia 


| (b)(6). (b)(7)(C) 

Ruskobank 
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I (b)(6), (b)(7)(C) ~T 


St. Petersburg, Russia 


| (b)(6) (b)(7)(C) I 

Aizkraukles Banka 
Riga, Latvia 

Swift: I (b)(6),(b)(7)(C) I 

In August of 2007, all PayPal accounts associated with Operation Flicker were 
terminated. Since this time. 1-hrPP merchant accounts haw been irlpnHfipH 
| (b)(7)(E) | 

were to websites offering memberships to access child pornography. Agents at 
C3 conducted several of these purchases in an effort to identify subjects 
responsible for processing payments for these websites. Subjects identified 
are acting as merchants, or business owners, and obtaining such authority from 
specific banks to process payments for Visa, and MasterCard credit cards. 

Once such merchant suspected to be residing in Los Angeles, California is wire 
transferring large sums of money from his personal bank account to a location 
in London. The following are details concerning this activity. 


(b)(6), (b)(7)(C) 


Los Angeles, CA 90010 

And 

| (b)(6), (b)(7)(C) | 

Los Angeles, CA 90020 

| (b)(6), (b)(7)(c) 1 personal bank account is the merchant account designated to receive 

the payments from his onlin e business. Representatives at JP Morgan Chase 
made contact with I I on May 13, 2008 and informed him that he needed to 

establish a business account if he planned on utilizing the accou nt for 
business purposes. Repre sentatives also confirmed the address of I < b >< B > (b>(7)(c> | 

| (b)(6) (b)(7)(c) | . Los Angeles, CA 90020. 

According to bank records received from JP Morgan Chase, I tb)CG> tb)(7)tc) | is wire 
transferring large sums of money in the amounts between $3 , 550 . 00, and 
$7,700.00 to the following location: 

Bank to Bank Info: /ACC/BANK OF CYPRUS LIMITED 51 STAS 

SINOS STREET AY I A NICOSIA CY 

Credit Party: I msymixc) \ 

BANK OF CYPRUS PUBLIC COMPANY LTD 
10, KYRILACOU MATSI AVENUE 
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AYIOL OMOLOYITES 
NICOSIA CYPRUS 27072 


Account Party: | (b>(6> i (b)(7)(c> | 

SUBADRA S YSTEMS LIMITED 
| (b)(6), (b)(7)(cT] , 456-458 STRAND 
LONDON GBR 

| (b)(6), (b)(7)(C)~| apparently processes payments from his online business, known as Geo 
Locator. Geo Locator is reportedly a software which will allow the user to 
identify the location of an Internet Protocol address. Agents of C3 conducted 

(b)(6), (b)(7)(C), (b)(7)(E) 


It is unknown at this time if there is a connection between I ] and SUBADRA 

SYSTEMS LIMITED. There is no specific evidence at this time that suggests 
that these two entities are related. 

This investigation continues. 
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CASE NUMBER I (b)(7)(E) \ 


TITLE: COMMERICAL CP WEBSITE KNOWN AS ^ | 






CASE STATUS: 

INTERIM RPT 



REPORT DATE 
081408 

DATE ASSIGNED 
072606 

PROGRAM CODE 

EE 

REPORT NO. 
079 

RELATED CASE NUMBERS: 

COLLATERAL REQ: 


TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 
/ OTHER INFORMATION 


TOPIC: MEETING WITH EUROPOL ON AUGUST 5, 2008. 


The ICE office of the Resident Agent in Charge, Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3), along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child ppornography website 
memberships . 


On August 4 and 5, 2 008- Senior Sp ecial Agent | (b)(B) (b)(7)(C) I of RAC/.RI...M and 

Senior S pecial Agent I (b>(6>,(b>(7>(c> [ G f Q 2 met with ICE representative I io I 

| (b)(6), (b)(7)(C)~| from ICE Attache Benelux, and officials from Europol regarding 
Operation Flicker and Operation Robin. 


DISTRIBUTION: 

SIGNATURE: 

| (b)(7)(E) | 

| SPECIAL AGENT 



APPROVED : 

| (b)(6>, (b)(7)(C) | OI GRP SUPERVISOR 

ORIGIN OFFICE: BI 
BIRMINGHAM, AL - RAC 

TELEPHONE : 2 0 5 2 9| | 

TYPIST: | (b)(6), (b)(7)(C) | 
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CASE NUMBER I (b)(7)(E) T 

REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: 079 


DETAILS OF INVESTIGATION; 


The ICE office of the Resident Agent in Charge, Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, Federal 
Bureau of Investigation (FBI) , the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child ppornography website 
memberships . 

On August 4, 2 008, SSA I (b)(6), (b)(7)(C) | and SSA TT^/A 0 ! met with ICE representative 
I (b>(6~(b)(7)(c> | from ICE Attache Benelux regarding the ongoing commercial child 

exploitat ion in ves tigation. Operation Flicker. In addition, the information 
that SSAs and [ (b)(6), (b)(7)(C) I prepared f or t he Europo l meeting was discussed. 

On August 5, 2008, SSAs I (b>(6>, (b)(7)(C) | . i, u and I (b)(6) (b)(7)(C) | attended a meeting at 
Europol regarding a European initiative entitled Operation Robin. Officals 
present included representatives from the Dutch National Police (DNP) , the 
Norwegian National Criminal Investigative Service (NCIS) , Europol, and the 
Child Exploitation and Online Protection Center (CEOP) of London, UK. The 
meeting revolved around investigative activity being conducted by the 
participating countries regarding an international criminal organization 
operating several hundred commercial child exploitation websites. 

Specifically, representatives from the DNP presented details of their 
operation, entitled Operation Robin, which overlapped with Operation Flicker. 
Overlapping aspects concerned the current mechanism for payment regarding the 
websites in question. An entity known as DA PAY, is currently the name of the 
website facilitating the payments for the memberships to the child pornography 
websites. Informati on regarding DA PA Y is outlined in detail within report of 
investigation number [ wig) ( b)(7)(C) (b)(7)(E) | , authored by SSA of C3 . DNP 

representatives expressed their concern for ongoing communication efforts 
between the participating countries in an effort to attempt to eliminate 
internet commercial child exploitation. 

SSA presented details concerning Operation Flicker , including recent 

discoveries of new payment process ors. SSA als o addressed the request 

made by the DNP outlined in report I (b>(6) (b>(7)(c> (b)(7>(E> | . which will be provided 

in formal terms by Assistant Attache Beckman to the DNP. Recommendations were 
made by each respective participant on further actions and investigative 
methods to be taken. Suggestions by members of Europol included foreseeable 
meetings to share investigative information. 

ICE agents will continue to work with ICE Attache offices, CEOP, Europol, and 
other entities to further current and future ICE investigations. 
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CASE NUMBER I (b)(7)(E) I 






TITLE : COMMERICAL CP WEBSITE KNOWN AS |Jg; 

CASE STATUS: 

INTERIM RPT 




REPORT DATE 
081408 

DATE ASSIGNED 
072606 

PROGRAM CODE 

TW\ 

REPORT NO. 
080 

RELATED CASE NUMBERS: 


COLLATERAL REQ: 


TYPE OF' REPORT:' 

OTHER INFORMATION / INVESTIGATIVE FINDINGS 

I 


TOPIC: MEETING WITH OFFICALS OF LONDON, UK CHILD EXPLOITATION CENTER 


' "'SYNOPSIS: 

The ICE office of the Resident Agent in Charge, Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States 'Attorney ' s 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of child pornography website memberships. 

On August 6 and 7, 2 008. Senior Sp ecial Agent f~ wig) ( b)(7)(C) ~| of RAC/BI and 

Senior Special Agent I (b)(6), (b)(7)(C) f Q f C3, met with officers of the Child 
Exploitation and Online Protection Center (CEOP) located in London, UK. The 
meeting was for the purpose of reviewing information gathered regarding leads 
produced by Operation Flicker and referred to CEOP in May of 2008. 


DISTRIBUTION: 

SIGNATURE: 

1 (b)(7)(E) | 

| (b>(B), (b)(7)(C) 1 SPECIAL AGENT 



APPROVED : 

| (b)(6), (b)(7)(C) | OI GRP SUPERVISOR 

ORIGIN OFFICE: BI 
BIRMINGHAM, AL - RAC 

TELEPHONE: 205 23 w 7c\° n/ ' 1 

TYPIST : 1 (b)(6), (b)(7)(C) | 
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REPORT NUMBER: 080 


DETAILS OF INVESTIGATION: 

The ICE office of the Resident Agent in Charge, Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of child pornography website memberships. 

On August 6 and 7, 2 008, Senior Sp ecial Agent T (b>(6>,(b>(7>(c> ~| of RAC/BI and 

Senior Special Agent f (b)(6), (b)(7)(C) | of C3, met with officers of the Child 

Exploitation and Online Protection Center (CEOP) located in London, UK. The 
meeting was for the purpose of reviewing information gathered regarding leads 
produced by Operation Flicker and ref erred to CEOP in May o f 2008. 

Information regarding a subject named T (b>(6>,(b)(7>(c> | residing in London 

was reviewed in an effort to ascertai n if hi s activities coincided with the 
activities of a subject also known as I | who is responsible for recruiting 

and directing the payments processed by certain websites containing child 
pornography. CEOP Officer ! (b)(6), (b)(7)(C) 1 generated intelligence reports based 

on bank record reviews obtained, as well as criminal history data. Officer 
determined no crimi nal history existe d for the subject identified as 
^^^ = (b)(6) l (b>(7)(C) | , born | (b>(G> (b>(7>(c> | . SS A | (b>(6> (b>(7>(c71 was allowed the 

opportunity to review the bank records, which revealed that no outstanding 
activities existed related to domestic or international wire transfers, nor 
did the records reveal any large sums of deposits or withdraws. He i s employed 
as a coach at K ent County Cricket Club, where he works with his wife, | (b>(S).(b>(7>(C)~~| 
| (b)(6), (b)(7)(C) 1 . No outstanding transactions were noted within her bank records 

nor does she have a criminal history. Based on in format ion collected and 
reviewed bv officers at CE OP and SSAs | :b>(G> (b>(7>(c> | and |^/ r \ D) | , the subject known as 
| (b)(G> (b)(7)(c) | born I (b)(G) (b)(7)(C) | does not match the activity patterns of 

the subject known as I (b)(6), (b)(7HC)[ identified during the course of Operation 
Flicker. Should further information arise regarding either subject, this 
matter will be reviewed again. 

Further leads provided to CEOP for assistance included business identified as 
the following: 


(b>(eK(b)(7>ec> 


LONDON GBR 

The above listed business is receiving wire transfers from a subject believed 
to be residing in Los Angeles, California, known as : T 
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and if found to be present in th e United S tates as of the date of this report, 
will be considered an overstay. I (b>(6>, (b)(7)(C) | has a registered business selling 
software reported to be designed to determine the geographical location of 
an IP address. The business name is GEO LOCATOR, website address listed as 
http://geo-locator.com. Bank records reviewed for this subject and the 
corresponding merchant account reveal that amounts posted to the account are 
in the amounts concurrent with those of child pornography webs ite v membership 
amounts . Covert purchases made by agents at C3 were traced through this 
merchant account as well. Three purchases have been conducted as of this date. 
One purchase was con ducted directly to the GEO LOCATOR website, see report of 
investigation number ! (b>(6>, (b)(7)(C), (b)(7)(E) | , This purchase was processed, however 

the underco ver agent never received a product. 

| (b)(6), (b)(7)(C) | bank records also reveal that his outgoing international wire 

transfers are being sent to the following: 

BANK OF CYPRUS PUBLIC COMPANY LTD 
10, KYRILACOU MATSI AVENUE 
AYIOL OMOLOYITES 

Funds are directed to a business: 


| (b)(6), (b)(7)(C) | 

LONDON GBR 

Officers at CEOP are currently requesting bank account information regarding 
SUBADRA SYSTEMS LIMITED. Officers conducting investigations within the UK, are 
required to follow the guidelines outlined within Article 8 of the European 
Convention on Human rights. Due to this requirement, bank records are obtained 
by making application to the UK courts, with permission granted by a judge. 

This is a timely affair and therefore, the records requested on SUBADRA SYSTEMS 
LIMITED will be p rovided by CEOP at a later date. The company is registered 
under the name of I (b>(G> (b>(7)(c> | . 


(b)(6), (b)(7)(C) 


Additional subjects discussed involved SMART VPN SERVICES LTD., located at 5, 
Percy Street, Office 4, London, WIT IDG. This company registered in London 
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is providing server access between the websites hosting the child pornography 
and the end users, to conceal the connection to these pay for v iew sites. 
SMART VPN SERVICES LTD has a director listed as I (b)(BMb)(7)(C) | . born 


I (b)(6), (b)(7)(C) |, wit h a La tvian addr ess . Also a company secretary is listed as 

I (b)(6), (b)(7)(C) born | (b)(6), (b)(7)(C) | _ with a London address . 

Further information regarding the above listed entities will be provided by 
CEOP since these leads are located within their jurisdiction. Coordination 
has been made with the ICE Attache office located in London. Senior Special 
Agent/Assistant Attache I (b)(6), (b)(7)(C) | was briefed regarding the activities 

concerning the above . 

ICE agents will continue to work with ICE Attache offices and CEOP to further 
current and future ICE investigations. 
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REPORT NUMBER: 081 

DETAILS OF INVESTIGATION: 


Project Flicker i b is an ongoing joint investigation between Immigration and 
Customs Enforcement (ICE), Resident Agent in Charge, Birmingham, Alabama 
(RAC/BI), ICE Cyber Crimes Center (C3/CES) , the Postal Inspection Service, the 
United States Attorney's Office for the Northern District of Alabama, and the 
Department of Justice/CEOS that has targeted both the principles facilitating 
subscription payments and the actual subscribers of several commercial child 
exploitation member restricted websites. The project has identified numerous 
separate child exploitation member restricted websites and the respective 
payment methods associated with each web site. On October 4 , 20 07 . ICE/C3/CES 
accessed an advertising website known as located at URL 



database and the following information was extracted: 
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(b)(3): 1 8 U.S.C. § 3509(d) Child victims' and child witnesses' rights, (b)(3): 18 U.S.C. § 3509(d) (Federal Victims' Protection and Rights Act), (b)(6), (b)(7)(C), (b)(7)(E) 


This investigation continues. 
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RELATED CASE NUMBERS: 


COLLATERAL REQ: 


TYPE OF REPORT: 
OTHER INFORMATION 


TOPIC: CASE UPDATE 


SYNOPSIS : 

Project Flicker (I^V'D is an ongoing investigation between Immigration and 
Customs Enforcement (ICE), Resident Agent in Charge, Birmingham, Alabama 
(RAC/BI) , ICE Cyber Crimes Center (C3/CES) , the Postal Inspection Service, the 
United States Attorney's Office for the Northern District of Alabama, and the 
Department of Justice/CEOS that has targeted both of the principles 
facilitating subscription payments and the actual subscribers of several 
commercial child exploitation member restricted websites. The project has 
identified numerous separate child exploitation websites and the associated 
payment methods. The purpose of this report is to document the organizations 
method of operation. 


Child Pornography websites identified by agents of C3 during the course of this 
investigation initially utilized PayPal Inc., for the processing mechanism. 
Agents analyzed the PayPal accounts of 14 processors in an effort to further 
identify other individuals within the criminal organization. 
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DETAILS OF INVESTIGATION: 


Project Flicker ( | E is an ongoing investigation between Immigration and 
Customs Enforcement (ICE) , Resident Agent in Charge, Birmingham, Alabama 
(RAC/BI) , ICE Cyber Crimes Center (C3/CES ) , the Postal Inspection Service, the 
United States Attorney's Office for the Northern District of Alabama, and the 
Department of Justice/CEOS that has targeted both of the principles 
facilitating subscription payments and the actual subscribers of several 
commercial child exploitation member restricted websites. The project has 
identified numerous separate child exploitation websites and the associated 
payment methods. The purpose of this report is to document the organizations 
method of operation. 

Child Pornography websites identified by agents of C3 during the course of this 
investigation initially utilized PayPal Inc., for the processing mechanism. 
Agents analyzed the PayPal accounts of 14 processors in an effort to further 
identify other individuals within the criminal organization. The organization 
recruited individuals to process payments utilizing two main recruiting methods 
The methods were uncovered through examination of email correspondence obtained 
through search warrants, as well as from statements made during the interviews 
of the PayPal account holders. Both methods are outlined below. 
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This investigation continues. 
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RELATED CASE NUMBERS: 

COLLATERAL REQ: 

TYPE OF REPORT: 
OTHER INFORMATION 

TOPIC: RETURN OF EVIDENCE 


SYNOPSIS : 

Project Flicker i (l ?n ' 1 1> is an ongoing investigation between Immigration and 
Customs Enforcement (ICE), Resident Agent in Charge, Birmingham, Alabama 
(RAC/BI), ICE Cyber Crimes Center (C3/CES) , the Postal Inspection Service, the 
United States Attorney's Office for the Northern District of Alabama, and the 
Department of Justice/CEOS that has targeted both of the principles 
facilitating subscription payments and the actual subscribers of several 
commercial child exploitation member restricted websites. The project has 
identified numerous separate child exploitation websites and the associated 
payment methods . 

On August 6, 2009, in accordance with DHS/ ICE policy conc erning single status 
evidence . Lin e Item 001 of seizure number I (b)(7)(E) | was returned to 

I (b)(6), (b)(7)(C) | of | lb)(G) (b)(7)(C) I , Illinois. 
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DETAILS OF INVESTIGATION: 


Project Flicker is an ongoing investigation between Immigration and 

Customs Enforcement (ICE), Resident Agent in Charge, Birmingham, Alabama 
(RAC/BI) , ICE Cyber Crimes Center (C3/CES) , the Postal inspection, Service, the 
United States Attorney’s Office for the Northern District of Alabama, and the 
Department of Justice/CEOS that has targeted both of the principles 
facilitating subscription payments and the actual subscribers of several 
commercial child exploitation member restricted websites. The project has 
identified numerous separate child exploitation websites and the associated 
payment methods. 

On August 6, 2009, in accordance with DHS/ ICE policy conc erning single status 
.evidence.. Line Tf.p.m 001 of aelzms number I < b >< 7 >< E > I was returned to 

I (b)(6), (b)(7)(c) |, Illinois. Return of the property to 

m b> | was made by agents of the St. Louis ICE office and evidence of th e 
return was forwarded to RAC/BI consisting of CBP Form 6051S, sigend by 
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SYNOPSIS : 

Project Flicker d I) is an ongoing joint investigation between Immigration 
and Customs Enforcement (ICE) , Resident Agent in Charge, Birmingham, Alabama 
(RAC/BI) , ICE Cyber Crimes Center (C3/CES) , the Postal Inspection Service, the 
United States Attorney's Office for the Northern District of Alabama, and the 
Department of Justice/CEOS that has targeted both the principles facilitating 
subscription payments and the actual subscribers of several commercial child 
exploitation member restricted websites. The project identified numerous 
separate child exploitation member restricted websites and the respective 
payment methods associated with each website. 


On January 27, 2010 in accordance with evidence retention guidelines, Line 
Item 001 from seizure | (b)(7)(E) | was destroyed and recorded via CBP Form 

7605 Disposition Order issued by Customs and Border Protection. 
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Project Flicker TST^ an ongoing joint investigation between Immigration 
and Customs Enforcement (ICE), Resident Agent in Charge, Birmingham, Alabama 
(RAC/BI) , ICE Cyber Crimes Center (C3/CES) , the Postal Inspection Service, the 
United States Attorney's Office for the Northern District of Alabama, and the 
Department of Justice/CEOS that has targeted both the principles facilitating 
subscription payments and the actual subscribers of several commercial child 
exploitation member restricted websites. The project identified numerous 
separate child exploitation member restricted websites and the respective 
payment methods associated with each website. 


On January 27, 2010 i n accordance with evidence retention guidelines, Line 
Item 001 from seizure | (b)(7)(E) | W as destroyed and recorded via CBP Form 

7605 Disposition Order issued by Customs and Border Protection. 


Original CBP Form 7605 was mailed to CBP, New Orleans, LA and updated in 
SEACATS . 
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TYPE OF REPORT: 
OTHER INFORMATION 


TOPIC: CASE UPDATE 


SYNOPSIS: 

Project Flicker ( I^VM ) is an ongoing joint investigation between Immigration 
and Customs Enforcement (ICE), Resident Agent in Charge, Birmingham, Alabama 
(RAC/BI) , ICE Cyber Crimes Center (C3/CES) , the Postal Inspection Service, the 
United States Attorney's Office for the Northern District of Alabama, and the 
Department of Justice/CEOS that has targeted both the principles facilitating 
subscription payments and the actual subscribers of several commercial child 
exploitation member restricted websites. The project identified numerous 
separate child exploitation member restricted websites and the respective 
payment methods associated with each website. 

This investigation is being placed in pending status until all evidence and 
collateral investigations can be closed. 
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Project Flicker is an ongoing joint investigation between Immigration 

and Customs Enforcement (ICE) , Resident Agent in Charge, Birmingham, Alabama 
(RAC/BI) , ICE Cyber Crimes Center (C3/CES) , the Postal Inspection Service, the 
United States Attorney's Office for the Northern District of Alabama, and the 
Department of Justice/CEOS that has targeted both the principles facilitating 
subscription payments and the actual subscribers of several commercial child 
exploitation member restricted websites. The project identified numerous 
separate child exploitation member restricted websites and the respective 
payment methods associated with each website. 


On August 16, 2010, i n accordance with evidence retention guidelines, Line 
Item 001 from seizure I (b)(7)(E) | was destroyed and recorded via CBP Form 

7605 Disposition Order issued by Customs and Border Protection. 
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DETAILS OF INVESTIGATION: 


Project Flicker j \ is an ongoing joint investigation between Immigration 
and Customs Enforcement (ICE) , Resident Agent in Charge, Birmingham, Alabama 
(RAC/BI) , ICE Cyber Crimes Center (C3/CES) , the Postal Inspection Service, the 
United States Attorney's Office for the Northern District of Alabama, and the 
Department of Justice/CEOS that has targeted both the principles facilitating 
subscription payments and the actual subscribers of several commercial child 
exploitation member restricted websites. The project identified numerous 
separate child exploitation member restricted websites and the respective 
payment methods associated with each website. 


On August 16, 2010, i n accordance with evidence retention guidelines, Line 
Item 001 from seizure | (b)(7)(E) | was destroyed and recorded via CBP Form 

7605 Disposition Order issued by Customs and Border Protection. 

On August 24, 2010, i n accordance with evidence retention guidelines, Line 
Item 002 from seizure I (b)(7)(E) | was destroyed and recorded’ - via CBP Form 

7605 Disposition Order issued by Customs and Border Protection. 

Information in Seacats was updated to reflect the destructions of both line 
items . 
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Project Flicker is an ongoing joint investigation between Immigration 

and Customs Enforcement (ICE) , Resident Agent in Charge, Birmingham, Alabama 
(RAC/BI), ICE Cyber Crimes Center (C3/CES), the Postal Inspection Service, the 
United States Attorney's Office for the Northern District of Alabama, and the 
Department of Justice/CEOS that has targeted both the principles facilitating 
subscription payments and the actual subscribers of several commercial child 
exploitation member restricted websites. The project identified numerous 
separate child exploitation member restricted websites and the respective 
payment methods associated with each website. 


This investigation is being placed in pending status until all evidence and 
collateral investigations can be closed. 
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REPORT NUMBER: 087 


DETAILS OF INVESTIGATION: 


Project Flicker (I b is an ongoing joint investigation between Immigration 
and Customs Enforcement (ICE) , Resident Agent in Charge, Birmingham, Alabama 
(RAC/BI), ICE Cyber Crimes Center (C3/CES) , the Postal Inspection Service, the 
United States Attorney's Office for the Northern District of Alabama, and the 
Department of Justice/CEOS that has targeted both the principles facilitating 
subscription payments and the actual subscribers of several commercial child 
exploitation member restricted websites. The project identified numerous 
separate child exploitation member restricted websites and the respective 
payment methods associated with each website. 


This investigation is being placed in pending status until all evidence and 
collateral investigations can be closed. 
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Project Flicker {_^J) is an ongoing joint investigation between Immigration 
and Customs Enforcement (ICE) , Resident Agent in Charge, Birmingham, Alabama 
(RAC/BI), ICE Cyber Crimes Center (C3/CES) , the Postal Inspection Service, the 
United States Attorney's Office for the Northern District of Alabama, and the 
Department of Justice/CEOS that has targeted both the principles facilitating 
subscription payments and the actual subscribers of several commercial child 
exploitation member restricted websites. The project identified numerous 
separate child exploitation member restricted websites and the respective 
payment methods associated with each website. 


In March of 2011, distruction orders were completed on all remaining evidence 
being stored for this investigation. 
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DETAILS OF INVESTIGATION: 


Project Flicker ra is an ongoing joint investigation between Immigration 
and Customs Enforcement (ICE), Resident Agent in Charge, Birmingham, Alabama 
{RAC/BI) , ICE Cyber Crimes Center (C3/CES) , the Postal Inspection Service, the 
United States Attorney's Office for the Northern District of Alabama, and the 
Department of Justice/CEOS that has targeted both the principles facilitating 
subscription payments and the actual subscribers of several commercial child 
exploitation member restricted websites. The project identified numerous 
separate child exploitation member restricted websites and the respective 
payment methods associated with each website. 

In March of 2011, distruction orders were completed on all remaining evidence 
being stored for this investigation. Line items listed for distruction 
consisted of email account contents collected by companies such as Yahoo!, 

MSN Hotmail, and Time Warner. All compact discs containing the material 
searched were distroyed by breaking and tearing and burning. 

This investigation is closed. 
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INVESTIGATIVE FINDINGS 
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TOPIC: REFERRAL OF 

SUBSCRIBERS TO ITALIAN POLICE 



SYNOPSIS : 

DETAILS OF INVESTIGATION: 

In April 2007, the ICE Cyber Crimes Center (C3) advised the Attache Rome of 
their investigation into 18 web sites that contain child pornography. In 
conjunction with the RAC Birmingham, C3 has obtained the subscriber list and 
transaction history for the subscribers to the various web sites. Sixty-four 
subscribers were identified as residing in Italy. In April 2007, the Attache 
Rome received an evidentiary package with details of the subscribers, and 
copies of various images from the web sites. In April 2007 the Attache Rome 
also learned that the Italian Polizia di Stato in Udine, Italy were al so 
conducting an investigation into the web site known as " EES • 


On April 20, 2007 the Attache Rome met with Officers of the Polizia di Stato 
(Postal & Telecommunications Division) and provided them with the evidentiary 
package and a synopsis of the ICE investigation. Additional information will 
be reported as it becomes available. 
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TOPIC: FEBRUARY 2008 UPDATE 


SYNOPSIS : 

DETAILS OF INVESTIGATION: 

In April 2007, the ICE Cyber Crimes Center (C3) advised the Attache Rome of 
their investigation into 18 web sites that contain child pornography. In 
conjunction with the RAC Birmingham, C3 has obtained the subscriber list and 
transaction history for the subscribers to the various web sites. Sixty- four 
subscribers were identified as residing in Italy. On April 20, 2007 the 
Attache Rome met with Officers of the Polizia di Stato (Postal & 
Telecommunications Division) and provided them with the evidentiary package 
and a synopsis of the ICE investigation. 

On Februa ry l, 2008 S/A Siggins was advised by Polizia di Stato Officer 
\ (b)(6), (b)(7)(c>| that they have identified 84 targets. One of the targets had spent 
4500 Euro over a two month period of time. Their investigation is ongoing, 
and additional details will be reported as they become available. 
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TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 


TOPIC: ENFORCEMENT ACTIVITY IN ITALY OCT. 23, 2008 


In April 2007, the ICE Cyber Crimes Center {C3) advised the Attache Rome of 
their investigation into 18 web sites that contain child pornography. In 
conjunction with the RAC/Birmingham, C3 has obtained the subscriber list and 
transaction history for the subscribers to the various web sites. Sixty four 
subscribers were identified as residing in Italy. A copy of the evidentiary 
package containing log files and payments receipts was shared with the Italian 
Postal and Communications Police. The investigation was furthered in Italy to 
a total of ninety- four targets. Search warrants have been executed on October 
23 in 38 Italian cities. 
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DETAILS OF INVESTIGATION 

Based on information received from the National Center for Missing and 
Exploited Children (NCMEC) regarding a commercial website offering child 
pornography for sale, the Cyber Crimes Center (C3) , Child Exploitation 
Section (CES) , initiated an investigation code named "Operation Flicker" . The 
investigation has identified that a specific criminal organization is 
operating over 18 different commercial child pornography advertising websites 
which provide access to over 18 child pornography member restricted websites. 
This criminal organization has utilized a specific and identifiable payment 
website known as "iWest." 

In conjunction with National Center for Missing and Exploited Children's 
(NCMEC) Financial Coalition Against Child Pornography (FCACP) , ICE/C3/CES has 
conducted over 60 I (b)(7)(E) | at the advertising websites 

associated with this investigation. Project FLICKER has generated 
approximately 5,000 domestic and foreign subscriber leads. 

The investigation is being worked jointly with ICE/C3 / CES , 

ICE/RAC/Birmingham, the U.S. Postal Inspection Service, the Federal Bureau of 
Investigation (FBI), the U.S. Department of Justice (DOJ) , Child Exploitation 
and Obscenity Section (CEOS), and the United States Attorney's Office (USAO) 
for the Northern District of Alabama. 

In conjunction with the RAC/Birmingham, C3 has obtained the subscriber list 
and transaction history for the subscribers to the various web sites. Sixty 
four subscribers were identified as residing in Italy. A copy of the 
evidentiary package containing log files and payments receipts was shared with 
the Italian Postal and Communications Police. The investigation was furthered 
in Italy to a total of ninety- four targets. 

On October 23, 2008, the Udine section of the Postal and Communications Police 
of Italy completed an enforcement action pursuant to the fight against child 
pornography on-line. 98 search warrants have been completed against 98 targets 
of investigation located in 37 different Italian provinces. 

The enforcement action in Italy has been coordinated by the National Center 
for the Fight against On-Line Pedophilia of the Postal and Communications 
Police of Italy. Italian investigators assigned to this unit "patrol" the net 
to identify potential violations of law among the items that get posted to the 
various web pages. 

The Procure of the Republic in Trieste coordinated the resource intensive 
.investigation. Investigative efforts were aimed at corroborating the evidence 
against the Italian subscribers who downloaded such videos as well as locating 
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the server and finding the beneficiaries of the subscription fees. The 
Italian investigators c onducted undercov er activities and collected evidence 
that the website named g I " was offering videos of children of 

various ethnic groups and of ages varying between 2 and 8, exploited sexually 
by adults . 

The ages of the targets of investigation in Italy vary from 26 to 59 years. 

The enforcement activity conducted in Italy on October 23, 2008, produced the 
following results : 

2 arrests in Trento based on large quantity, 119 computers, 171 external hard 
disks, 3653 CD-ROMs, 697 DVDs, 362 Floppy discs, 47 memory sticks, 579 VHS 
cassettes, 50 pen drives. 

The above hardware will undergo forensic analysis in order to develop 
additional leads. 

UNDEVELOPED LEADS: 

This case will remain open pending receipt of additional leads upon forensic 
examination of seized hardware. 
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In April 2007, the ICE Cyber Crimes Center (C3) advised the Attache Rome of 
their investigation into 18 web sites that contain child pornography. In 
conjunction with the RAC/Birmingham, C3 has obtained the subscriber list and 
transaction history for the subscribers to the various web sites. Sixty four 
subscribers were identified as residing in Italy. A copy of the - ' evidentiary 
package containing log files and payments receipts was shared with the Italian 
Postal and Communications Police. The investigation was furthered in Italy to 
a total of ninety- four targets. Search warrants were executed on 10/23/08 
in 38 Italian cities. 


On June 19, 2009. this writer cont acted Italian Postal and Communications 
Police detective I (b)(6), (b)(7)(c) | for an update on the results of the 

search warrants. | (b)(6), (b)(7«c) | informed this writer that the forensic 

examinations of the hard drives were not over and that he would advise in 
due course. Investigation continues. 
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TOPIC: NO ADDITIONAL LEADS DEVELOPED BY 

ITALIAN AUTHORITIES 



SYNOPSIS: 

In April 2007, the ICE Cyber Crimes Center (C3) advised the Attache Rome of 
their investigation into 18 web sites that contain child pornography. In 
conjunction with the RAC/Birmingham, C3 has obtained the subscriber list and 
transaction history for the subscribers to the various web sites. Sixty four 
subscribers were identified as residing in Italy. A copy of the,. evidentiary 
package containing log files and payments receipts was shared with the Italian 
Postal and Communications Police. The investigation was furthered in Italy to 
a total of ninety- four targets. Search warrants have been executed on October 
23, 2008, in 38 Italian cities and a large amount of hardware was seized for 
forensic analysis. 


13, 2010, SSA Q 


( b) (6) ' (b ) (7 ) ( c) I and this writer met with Mr. I I 
the Italian Poli ce Of ficial in cnarue of the forensic analysis of the 
seized hardware. Mr. l,h°mrrJ explained that the forensic analyis of the computers 
was negative. 
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DETAILS OF INVESTIGATIONS: 

In April 2007, the ICE Cyber Crimes Center (C3) advised the Attache Rome of 
their investigation into 18 web sites that contain child pornography. In 
conjunction with the RAC/Birmingham, C3 has obtained the subscriber list and 
transaction history for the subscribers to the various web sites. Sixty four 
subscribers were identified as residing in Italy. A copy of the evidentiary 
package containing log files and payments receipts was shared with the Italian 
Postal and Communications Police. The investigation was furthered in Italy to 
a total of ninety- four targets. Search warrants have been executed on October 
23, 2008, in 38 Italian cities and a large amount of hardware was' seized for 
forensic analysis . 

On Ja n. 13, 2010, SSA I mm.rnncj | and this writer met with Mr. [jJED 
r/yunl , the Italian Poli ce Of ficial in charge of the forensic analysis of the 
seized hardware. Mr. r/wffil explained that the forensic analysis of the images 
covered steganography also. However, no embedded messages were detected. 

No additional leads are contemplated at Rome, this case is closed. 
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SAC/Birraingham, AL, Project Flicker identified several subjects targets in the 
RAC/PB AOR who had subscribed and. 11 M 1 i 7.ed an illegal child pornography 
Internet site identified as The 11 1 ioimt'and ^dl^we^ewight I " • This site offered images 
and movies of hardcore child exploitation. 


ICE RAC/PB will further identify these users and review to determine 
investigative merit. 
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Several subjects were identified during SAC/Newark, NJ Operation Emissary and 
RAC/Birmingham, AL Project Flicker, operations to identify subscribers and 
users of illegal child pornography Internet sites. These sites offered images 
and movies of hardcore child pornography and abuse. Both operations identified 
targets in the RAC/PB AOR. 

The ASAC/Pittsburgh will continue to monitor and track case involving 
identified targets of ICE Project Flicker. 
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Several subjects were identified during SAC/Newark, NJ Operation Emissary and 
RAC/Birmingham, AL Project Flicker, operations to identify subscribers and 
users of illegal child pornography Internet sites. These sites offered images 
and movies of hardcore child pornography and abuse. Both operations identified 
targets in the ASAC/PB AOR. 

The ASAC/ Pittsburgh will continue to monitor and track case involving 
.identified targets of ICE Project Flicker. 
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Several subjects were identified during SAC/Newark, NJ Operation Emissary and 
RAC/Birmingham, AL Project Flicker, operations to identify subscribers and 
users of illegal child pornography Internet sites. These sites offered images 
and movies of hardcore child pornography and abuse. Both operations identified 
targets in the ASAC/PB AOR. 

The ASAC/Pittsburgh will continue to monitor and track case involving 
identified targets of ICE Project Flicker. ? 
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TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 


TOPIC: CLOSING OF GENERAL CASE NUMBER 


SYNOPSIS: 

SAC/ Birmingham, AL, Project Flicker identified several subjects targets in the 
RAC/PB AOR who had subscribed an d utilized an ill egal child pornography 
Ttit-fimpt" idpnlH f Seri ac* The n| ( B >( 3 > : IB u si - 5 J3U3 W cmia L r^v. : ^ -i m 

internee sice laencinea as ine lyicyms and child witnesses nahtsl • 
and movies of hardcore child exploitation. 


This site offered images 


This general case number will be closed. The leads generated by Operation 
Flicker will be kept and utilized as intelligence for future leads on known 
targets . 
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TELEPHONE: 412 43r Uft '58P , 'l 
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COLLATERAL REQ: 


TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 


TOPIC: RUSSIAN BUSINESS NETWORK 


SYNOPSIS: 

In June 2006, the Immigration and Customs Enforcement (ICE), Cyber Crimes 
Center (C3) , Child Exploitation Section (CES) received information relating 
to a web hosting company located in St. Petersburg, Russia known as Russian 
Business Network (RBN) . The information related to numerous commercial child 
pornography websites that were hosted at RBN. During the course of several 
ICE investigations, RBN has been identified as hosting commercial child 
pornography websites. 

This report will detail information related to the Russian Business Network. 
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DETAILS OF INVESTIGATION: 


In June 2006, the Immigration and Customs Enforcement (ICE), Cyber Crimes 
Center (C3), Child Exploitation Section (CES) received information relating 
to a web hosting company located in St. Petersburg, Russia known as Russian 
Business Network (RBN) . The information related to numerous commercial child 
pornography websites that were hosted at RBN. During the course of several 
ICE investigations, RBN has been identified as hosting commercial child 
pornography websites . 


In March 2005, ICE/ C3/CES initiated a national program dedicated to 
identifying and investigating commercial child pornography websites. Agents 
assigned to this program received information relating to these websites from 
the National Center for Missing and Exploited Children (NCMEC) , other ICE 
field offices, and other law enforcement agencies. The program was designed 
to identify unique commercial child pornography websites and initiate 
investigations in an effort to prosecute those individuals responsible for 
operating and controlling the websites. 


In May 2006, ICE/ C3/CES initiated one such investigation. To date the 
investigation has identified over 200 commercial child pornography websites 
linked to the same organization. In June/ July 2006, the investigation 
revealed that many of the commercial child pornography advertising and member 
restricted websites were hosted at a web hosting company known as Russian 
Business Network (RBN) . At the time the publicly available information 
(whois information) provided by the operator of RBN listed the following 
physical address: i 


12 Levashovsky Pr. 

197110 Saint-Petersburg, Russia 

In early 2007, RBN changed their publicly available contact information to: 


RBusiness Network 
The Century Tower Building 
Ricardo J. Alfari Avenue 
Panama City, Republic of Panama 
1.401.369.8152 


In addition, the following publicly available information was obtained: 


Name; RBN -AS 
Netname: RBNET 

Description: Russian Business Network 
Origin: AS40989 
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Peers: AS40989 adjoins 2 networks: Akimon and SBT 


Too coin Software Limited 
Shearway Business Park 16 
CT19 4RH Folkestone - Kent 
United Kingdom 
7 .921.401.5843 
1.347.438.2955 

The following represents possible contact information-. 



The following provides a current status of operations located at the Russian 
Business Network: 

At least 120 unique websites advertising the sale of c hild pornograp hy: the 
websites are concentrated on the following IP blocks : 1 (b>(s>,(b>(7>(c> [. 

I (b)(6), (b)(7)(C) in fact, a recent shift has been 

noticed for child pornography advertising websites; they have been 
concentrating at the RBN servers. No legitimate websites could be located on 
the RBN IP blocks; a sampling of IP addresses from I tb>(6>.(b>(7>(c> | 

provided no active, legitimate websites. This block of IP addresses is owned 
by RBN. A simi lar sampling was conducted with the same results on IP 
addresses from | (b>(G> (b>(?>(c> | . 

In addition to the above discussed child pornography advertising websites, 

RBN also hosts numerous child pornography member restricted websites. These 
are the websites that customers can access after paying the monthly 
membership fees; which currently range from $75 to $100 a month. Two of the 
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mor< 

are 


I Child victims' and child witnes I 300 I child witnesses' rights ,fbW3V 1 8 U S C 


s (acce ssing within the last 30 days) 

in te.fbw3vi8usc , s S 3509fdl- Both of the websites are 

located at the same IP address: I (b>(6> = (bx7xc> ) . These two websites contain in 

excess of 2 gigab ytes ch i Id pornography. Another recent membey restricted 

website, known a si ° m j . is also located at RBN . This website is located 


at IP address \ mey.mrxQ \ . in addition, to containing in excess of 
gigabytes of child pornographic material; this particular website allows 
users to upload their own child pornography. While an exact number of 
customers to each of the websites are not known; it is assumed that each of 
the websites has in excess of one hundred customers per 

month. We can not show the precise number of member restricted websites 
currently hosted at RBN; we have to purchase a membership before we are 
provide the location, and we have not purchased memberships to the 120 known 
child pornography advertising websites. We do assume that the corresponding 
member restricted website fpr each of the advertising websites will be hosted 
at RBN. 


Investigation continues 
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SYNOPSIS: 

In June 2006, the Immigration and Customs Enforcement (ICE) , Cyber Crimes 
Center (C3) , Child Exploitation Section (CES) received information relating 
to a web hosting company located in St. Petersburg, Russia known as Russian 
Business Network (RBN) . The information related to numerous commercial child 
pornography websites that were hosted at RBN. During the course of several 
ICE investigations, RBN has been identified as hosting commercial child 
pornography websites. 
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DETAILS OF INVESTIGATION: 


In June 2006, the Immigration and Customs Enforcement (ICE), Cyber Crimes 
Center (C3), Child Exploitation Section (CES) received information relating 
to a web hosting company located in St. Petersburg, Russia known as Russian 
Business Network (RBN) . The information related to numerous commercial child 
pornography websites that were hosted at RBN. During the course of several 
ICE investigations, RBN has been identified as hosting commercial child 
pornography websites . 

ICE/Attache/Moscow has been coordinating with the GUMVD for the North-Western 
Federal Region of Russia regarding the investigation of rbn. The gumvd 

requested that | < b >< 7 >( E > I of a child exploitation 

website hosted at RBN. This report will document one such purchase. 

On October 4, 200 7 . I C E / C3 /CES accessed a advertising 

website known as Isssoafrchiidl located at URL: I and dim witnesses rlahts.tbH3>. IS u.S.C. I- The website 
contained numerous links to other advertising websites, including but not 
limited to; 


(b)(3): 18 U.S.C. § 3509(d) Child 
victims' and child witnesses' rights, 
(b)(3): 18 U.S.C, § 3509(d) (Federal 
Victims' Protection and Rights Act) 


For each of the individual websites listed above, EsSZiiSS contained a screen 
shot of the main page for those individual advertising websites. In 
addition, a written description of the website was also displayed. The 
foi l nwi na wTj-J e r^d fj g c y i p h i on was extracted for the individual advertising 
webs i t e I vitf ima ' mil ohM^rnmsp^nnhr 1 : 

"Fresh dishy looks and fragra nce of sweet fruits brought you to the peaceful 
place called ESS if you only cast a glance at those absolutely 
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exotic fruits, you'll be fascinated by splendid and blossoming beauty of 
these young creatures . Breathtaking pictures and incomparable video will 
capture your attention and your eyes! The rest of the world outside this 
indisputably splendid garden will mean nothing to you!" 


°" 1 ^ mi i feV - ^u 

(b)(3): 18 U.S.C. § 3509(d) Child victims 1 
3509(d) (Federal Victim: 

from the web page: 


an JQE agent clicked on the hyperlink for 
whj .eh, r ed pi r.t ed to URL: 

^Sg (3> ' 8 U S C § I . The following text 


the advertising 
was extracted 


I (B)(3)! 18 U.y.U. ^ 35Uy(fl) UlMIfl I !( 

I victims' and child witnesses' right I 

"This One Contains 20 Collections" 

"3000 Photos 100 Pics In Each Set" 
"Unformatted 1.5GB Video Bonus" 

"Fantastic Collections" 

"Unforgettable Pictures" 

"Delicious Salad of Little Fetching Fruits" 
"None Will Stay Clam" 

"Each Picture Deserves A Thousand Words" 


The web page contained a hyperlink entitled "OPEN." In addition, the web 
page displayed one image of a prepubescent female minor. On the same date, 
the domain name Is- land. name was run through a publicly available database 
that identifies the registrant of the domain name as well as the hosting 
location. The following information was extracted from the publicly 
available database; 


Network Whoi s record 

Doma ^ Name | ‘ WawSS 

IP AHrirPSS •lr„'i„ 1,11 

Inetnum : |_ 


Netname : RBNET 

Descr : RBusiness Network 

0l L the f a !? e . da ™; ’’ 

redirected to URL: I . aaoat m if p.tip.rni viraimn’ PmiRiumn Rmhia ivji I- Tne wet) page 

displayed at the listed URL contained several other hyperlinks including one 
labeled “next pa3e 1 '; t ,, 3 , ( te^^y^^)^JgjLa p n^WSUg^', , ) eX1: pa3 ® 

~ - ' -l-~ | • 


redirected to URL: 


which 
The web page at 


the listed URL contained approximately 60 images of prepubescent female 
minors. In addition the following text was extracted from the web page: 


"Here you can see two pictures of each young lady. The first presents you an 
artistic portfolio picture and the other gives you ground for your 
imagination. When you become a member of our site, you can check whether 
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your imagination was realized in these pictures. Some of them can be a real 
pleasant surprise for you. Well, you are to decide whether you want to be 
caught and overwhelmed with beauty ! 11 


The web page also TO j j^rj mJBTSE u M ' " '*' ich , 

redirected to URL: I _ fdHFederal Victims' Protection and Rights Act) |. The Web page at 

the listed URL contains rules on becoming a member. In addition, there was a 
hvnp-vl i nlf "npvt- nanP » whifh redirected to URL: 

I (b)(3): 1 8 U.S.C. § 3509(d) Child victims' and child witnesses’ rights,(b)(3):18 use I , . ... . ___ _ 

I S 3509fdl I Federal Victims' Protection and Rights Acti |. The Web page at the listed URL 

contains six samples images taken from the member restricted website. In 
addition, there were two separate hyperlinks for the primary and secondary 
payment systems. 


On the same date, an ICE agent c licked the hyper link for the primary payment 

system, which redirected to URL: I I . The website at 

the listed URL was known as D.A. Technologies. The web page displayed a 
payment form requiring the customer to enter the following information: 
email; full name; country; address; city; zip code; phone; credit 7 card 
number; expiration date; CW2 code; issuing bank; and issuing bank telephone 
number. The web page listed the payment was for a $79.99 membership. The 
ICE agent entered the required information and clicked the "Secure Purchase" 
button, which redirected to another webpage indicating the transaction was 
successful. The following text was excerpted: 


"YOUR CARD HAS BEEN SUCCESSFULLY AUTHORIZED" 

"ORDER INFORMATION:" 

"Amount to be charged; 79.99" 

"Order ID; I (b>(6>.(b>(7>(c> | » 

"Name; I (b)(6) (b)(7)(c) |» 

"MrirPM . I (b)(G) (b)(7)(C) j 

"Phone: I (b)(6), (b)(7)(C) | n 
"Email: I WW ^c) |» 

"ATTENTION! ! ! » 

"To protect your privacy and avoid you from being associated with the 
purchased site, Your card will be billed for some computer software." 

"Soon You'll receive a formal email receipt from the software company with 
the details of this payment . " 

"Don't ask them about the membership! They think you've really bought their 
software!" 


"If you are contacted by billing support or by the staff of that software 
company, you must confirm that you purchased their software product and are 
satisfied with it." 
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"Your Member s j h ftpf QpafujVg 

"MRMRRP ^nMB • | rights, (b)(3): 18 U.S .C. § 3509(d) (Fed 

"LOGIN: 


7.QNE. Irigh 

Lr^ 

rdT | (b>(s 


" PASSWORDT ] (b)(6), (b)(7)(C) 

785 i ?yR p P^ Ml t!i?, l J 3 iaa^^^ ries regarding this order please visit, * 

"or send an email to:" 

„| — (b)(3)! IB U.S.U. b Sbliyfd) Uhild victims' ahd child — L, 

Iwimnnann' rinhta fh)ffU 1 fi i I R f) 6 3003(0) fFurinml Vi l 

On the same date, the ICE agent clicked t he hyperlink redirect inyj^to^ th e 
member restricted website located at URL, ESS S I5BSSS SSSS3- The 
initial web page contained several hyperlinks to other advertising websites. 
In addition, there was a hyperlink at the bottom of the webpage entitled 

I ^ Ml (Federal Victims' Protection and Rights Act) ' | . The Web page at the listed URL 

contained a hyperlink entitled "next page," which redirected to URL: 

I (b)(3). 15 U.5.L. S 14 u * . This was the main page of the 
member restricted website known as Forbidden Fruit. The web page at this URL 
contained approximately 60 images of prepubescent female minors (the same 
images displayed on the advertising website) . The images were displayed in 
10 rows, with each row containing six images. The six images were further 
broken down into three separate girls (with each girl having two images) . 

Each image of an individual girl was a hyperlink to the entire gallery of 
that girl . For ex 
ample, the ICE agen t 

redirected to URL: I |. This 

URL was the main page for the gallery for the individual girl original 
displayed as the first girl in the second row. The gallery contained 20 
thumbnail photos of the girl on each web page in her gallery. If a photo was 


L 

(b)(3): 18 U.S.C. § 3509(d) Child victims' and child witness) 

ss' rights, (b)(3):18 U.S.C. § 3509(d) (Federal Victims' Protection and Rights Act) 


Each of the 30 girls on the main page for the member restricted website 
contained a similar gallery. Each gallery contained approximately 100 images 


(b)(3): 1 8 U.S.C. § 3509(d) Child victims' and child witnesses' 
3 U.S.C. 5 3509(d) Child victims' and 1 . . J 

rights, (b)(3): 1 8 U.S.C. § 3509(d) (Federal Victims' Protection and Rights Act) 





captured the entire member restricted website. The member restricted website 
also contained a video bonus section with approximately 18 video files of 
prepubescent female minors . 
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The entire process, including the entire undercover purchase was recorded 
utilizing Camtasia. This is in addition to the entire capture of the member 
restricted website. 

The domain name membersl7.ls-land.com was entered into the publicly available 
database and the following information was extracted: 


Network Whoi, 

Domain Namej. 

IP ^ro cor (b)(6), (b)(7)(C) 




Netname :RBNET 
Descr : RBusiness Network 


ICE/C3/CES was able to verify the transaction with MasterCard. The merchant 
was identified as GEO LOCATOR from Brooklyn, New York. ICE/RAC/Birmingham is 
conducting additional investigative work to identify the owners of GEO 
LOCATOR. 


The following items were sent to ICE/Attache/Moscow for dissemination to the 
GUMVD : the Camtasia capture of I (b)(7)(E) _ I {including the access 

to the member restricted website) and the entire capture of the member 
restricted website. 


Investigation continues. 
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In June 2006 , the Immigration and Customs Enforcement (ICE) , Cyber Crimes 
Center (C3) , Child Exploitation Section (CES) received information relating 
to a web hosting company located in St. Petersburg, Russia known as Russian 
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DETAILS OF INVESTIGATION: 

In June 2006, the Immigration and Customs Enforcement (ICE), Cyber Crimes 
Center (C3) , Child Exploitation Section (CES) received information relating 
to a web hosting company located in St. Petersburg, Russia known as Russian 
Business Network (RBN) . The information related to numerous commercial child 
pornography websites that were hosted at RBN. During the course of several 
ICE investigations, RBN has been identified as hosting commercial child 
pornography websites. 

The Russian Business Network is no longer operational. This investigation is 
now closed. 
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CASE 

NUMBER | (b)(7)(E) | 


TITLE: COMMERCIAL CP WEBSITE KNOWN AS 


CASE STATUS: ~ INIT RPT 


REPORT DATE 

DATE ASSIGNED 

PROGRAM CODE 

REPORT NO. 

022409 

112008 

EJ 

001 


RELATED CASE NUMBERS: 


COLLATERAL REQ: 


TYPE OF REPORT: 

INITIAL SOURCE DOCUMENT 


TOPIC: CASE AGENT TRANSFER 


SYNOPSIS : 

SAC/Chicago is conducting an invest -iaation in to a commercial Child 
■Pnrrmmvmhv website known ar, L.— ... ——I The TCK Cyber Crimea Center 


(b>(7>(E> 


This case was assigned to SA in December 2008. 

ICE Investigation continues. 


DISTRIBUTION : 


| (b)(7)(E) | 

| (b>(6), (b)(7)(C) | SPECIAL AGENT 



ftpnpnwirn- 

1 (b)(6), (b) ( /)(o | OT RRP SUPERVISOR 

ORIGIN OFFICE: CH 
CHICAGO, IL - SAC 

TELEPHONE: 630 57P“'7A"''"I 

TYPIST- 
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CASE NUMBER 


CASE STATUS: 

CLOSING RPT 



REPORT DATE 

DATE ASSIGNED 

PROGRAM CODE 

REPORT NO. 

111010 

112008 


002 


RELATED CASE NUMBERS: 


COLLATERAL REQ: 


TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 


TOPIC: PROJECT FLICKER - INVESTIGATIVE STATUS - CLOSED 


SYNOPSIS : 

The U.S. Department of Homeland Security, ICE SAC/Chicago is conduct ing a n 
investigati on into a commercial Child Pornography website known as ll lnviai)l 
ESStoaHL. The ICE cvber Crimes Center (C3). in Fairfax, Virginia conducted 


This case was opened to track related investigations via collateral and 
local origination. 

Investigation is closed. 


DISTRIBUTION: 


1 (b)(7)(E) | 

[ (b)(6), (b)(7)(C) I SENIOR SPEC AGENT 



APPROVED: 

(b)(6), (b)(7)(C) | OI GRP SUPERVISOR 

ORIGIN OFFICE: CH 
CHICAGO, IL - SAC 

TET.RPHONR- RTl 1 

TYPIST: r'T l ,'" l "l 
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DETAILS OF INVESTIGATION 


This case was opene d as collateral to case number | (b)(7)(E) ~| < and base 

case I (b)(7)(E) | . The names of : th e cases are the same; "Commercial 

CP Website Known as | v SiS and child t^esiel^htsi 1 under the overall name of "Project 
Flicker" . The ICE SAC/ Chicago leads were worked under the names of the 
perpetrators vice the mentioned name. 


This case was originally opened to track all Project Flicker investigative 
leads which have pursued independently. 


Investigation is closed. 
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"TITLE : COMMERTCAL CP WEBSITE KNOWN AS C 


TECS ACCESS CODE 


CASE NUMBER [ 
3! g jjui(U) li mu | 


CASE STATUS: 

INIT RPT 



REPORT DATE 

DATE ASSIGNED 

PROGRAM CODE 

REPORT NO. 

061308 

060508 

ra 

001 

RELATED CASE NUMBERS: 


COLLATERAL REQ: 


TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 


TOPIC; OPENING ROI Q 


The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, Federal 
Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , Child 
Exploitation and Obscenity Section (CEOS), and the United States Attorney's 
Office (USAO) for the Northern District of Alabama are conducting an 
investigation in reference to Operation Flicker regarding the transmittal of 
monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have worked in conjunction with PayPal 
Inc. PayPal account holders identified as being processors for the member 
restricted child pornography websites have been forwarded to the r RAC/BI. 

This ROI covers the opening of the collateral request from the RAC/ BI to 
investigate the activities of I (bxo (b>(7>(c> ~| , Wayne, NJ 

07470 . 


DISTRIBUTION: 

SIGNATURE: 

| (b)(7)(E) 1 

| (b)(6), (b)(7)(C) | SENIOR SPEC AGENT 



APPROVED : 

1 (b)(6), (b)(7)(C) 1 SUP GRIM INVEST 

ORIGIN OFFICE: NK 
NEWARK, NJ - SAC 

TELEPHONE: 973 77I W '“«C"'"I 

TYPIST: I (b)(6), (b)(7)(C) | 
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DETAILS OF INVESTIGATION: 

The SAC/NK received a reque st from the RAC/ BI to determine the following 
concerning allegations that I (b>(6>(b>(7>(c> | was money processor for child 

pornography web sites and sending the proceeds to the operators of the child 
pornography. Previous investigations on individuals who were procession the 
money received from the child pornography web sites determined that the monies 
were wire transferred to bank accounts in Riga, Latvia. Specifically the 
RAC/Bi requested that the SAC/NK determine : 

The approximate date and time frame activity involving the PayPal transactions 
occurred. 

Any and all documentation related to this activity. 

Copies of correspondence via email and mail. 

Copies of Bank Records (if possible) concerning wire transfers. 


(b)(6), (b)(7)(C), (b)(7)(E) 


The RAC/BI provided the following on I (b)(6) (b)(7)(C) ~| : 


NAME: 

DOB: 

ADDRESS : 

Other Possible Address: 


(b)(6),(b)(7)(C) 

(b)(6), (b)(7)(c) I , Wayne, 


Wayne, NJ 07470 
NJ 07470 
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EMAIL ADDRESS: | (b)(6),(b)(7)(C) [ 

CRIMINAL HISTORY: Subject is a registered sex offender. On 11/08/1985, 

Subject was convicted of sexual assault and sentenced to ten years. On 
4/26/2004, Subject was convicted for endangering the welfare of a child and 
sentenced to three years probation. He was also arrested in Paterson NJ on 
01/14/1976 for a sex offense. 


On June 4, 2008 S/A I (b)(6), (b)(7)(C) ~| went to I (b)(6), (b)(7)(C) |. Wayne, NJ. 

This address is a U nited Parcel Service (UPS) .nt-n re on .Time 4 . ?nnft s/A 
| (b)(6), (b)(7)(c) | went to the second address of I . (b)(6), (b)(7)(c> | Wayne, 

NJ 07470. This is a townhouse complex. Residence | (b m(c> P> l is located on the second 
floor, rear residence within the complex. 

_ . I (b>(3>:18 uyij lj Sbuy(d) Uhild victims 1 I . . ^ ^ . I 1 

PD 2008 S/A land diu wiln.ia.i naHii IBK3I iSUS I met with Detective I MTOMm ra I 

(b)(6), (b)(7) of the Wayne, NJ Police Department. One of De tective Ser geant I (b)(6) (b)(7)(c) | 

(C) duty assignments is to track and maintain a ll I (b)(7)(c) | re gistrants 

wi thin the town of Wayne, NJ. Detective Sergeant I (b)(6), (b)(7)(C) ~| has no record 

of | (b)(6), (b)(7)(C) ~| being registered in the town of Wayne, NJ. 

On Ju ne 5, 2008 Postal Inspecto r | (b)(6), (b)(7)(C) *~1 infonnprt fl/A I" (b)(6), (b)(7)(C) ~| 

that I (b)(6) (b)(7)(C) | is ren ted by I (b)(6),(b)(7)(C) | P , S . 

Development En1~ . LLP. I l b )l B ),l b )l 7 )[q . I , Wayne, NJ 07 470. Phone numbers: 

973-801 ib>(6> (b)(7)(C) | work]. E-mail: | idig) ( b)(7)(C) ~| . 

| (b)(6), (b)(7)(c) I npsnprt the hnx in l/03. The owner of the UPS said that he 

is in almost every day to pick up his m ail (letters, magazines. 

parcels) . Postal Inspector | (b)(6), (b)(7)(C) | said that | (b)(6), (b)(7)(C) I had tw o 

boxes from Dell sitting there today when he went there . I (b)(6), (b)(7)(C) | gave 

the names to receive mail at the box as himself and P.S. Development E nt. 

LLC. He p rovided a photo driver 1 s license as ID (# | (b)(6), (b)(7)(C) \ , with 

an address | " (b)(6), (b)(7)(C) I , North Haledon, NJ 07508. He also used an 

AMEX card as ID: I <b>(B> <b) t 7> ( c> | . 

On June 6, 2008 Postal Inspector | (b)(6), (b)(7)(C) | informed fi/a I ( b)(6), (b)(7)(c) | 

that the individu al currently receiving mail at I (b)(6), (b)(7)(C) [ , Wayne, NJ is 

| (b)(6) (b)(7)(C) | . 


On June 9, 2008 S/ A I (b>(6> (b)(7>(c> | met with New Jersey State Police 

Detective Sergeant I (b)(6), (b)(7)(C) | Q f the New Jersey Cybercrimes unit , De tective 

Sergeant I (b)(6) (b)(7)(C) | provided the case file for the arrest of I lD)1 7A Dn/) I 

| (b)(6), (b)(7)(c) | j n October 2 002 the Dallas. Texas po lice department received 
information from the FBI that | (b>(6>, (b>(7)(c> ~| it c ard to make 

purchases t^_the_cMld_Po rno qraphy web sit eTchlidi^^^ The address 

given for i (b)(6), (b)(7)(C) | was I (b)(6), (b)(7)(C) Wayne, NJ 074 70. The e-mail 

iiapri was I (b)(6) (b)(7)(C) | . The telephone number used was 

| (b)(6), (b)(7)(c) | . The purchases took place on April 26, 2001 and May 21, 2001 
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using credit card number | (b)( 6 ), (b)( 7 >(c> I. A third pur chase took place on 

July 6, 2001 using credit, card number I (b )(6), (b)(7)(C) | pnr-th^r 

investigation by the NJ State police showed that | (b)( 6 ). (b)( 7 )(c) ] ^975 arrest 

was for "forcible masturbation of a 14 year old" and that the 1985 arrest was 
for fondling of 3 young boys. 1 


On April 26, 2004 New Stat e Police Officers conducted an interview with | wiMph') | 
| (b)(6), (b)(7)(c)| at his residence, I (b)C6>.ct»X7)fc> I, Way ne. NJ 07470. During the 
inte rview it was de term ined that I (b)(6), (b)(7)(C) f W as marr ied and his wif e name 
was l (b)(6), (b)(7)(c) ~1 dob I (b)(6), (b)(7)(C)| . He also had a daughter | (b)(6), (b)(7)(C) | who was 

4 and half year old at the time of the interview. 


During the course of the interview I (b)(6), (b)(7)(C) | consented to the New Jersey 

State Police officers examing his computer. .Purina the course of the exam, 
images of child pornography were uncovered. | (b)( 6 ), (b)( 7 )(C) | was arrested and 

pled guilty to the charge of endangering the welfare of a child. He was 
sentenced to NJ State prison and served time in prison from June 30, 2006 till 
his release on March 5, 2007. 

On June 10, 2008 S/A | =^>< 6 >[b wm | spoke to I (b)(6), (b)(7)(C) | Q f the 

Passaic County prosecutor 1 s office. She informed S /A I (b>(6), (b)(7)(C) | that 

| (b)(6), (b)(7)(C) \ y; ag a Tier 3 hig h risk offender and that the current address 

for him was 1 (b)( 6 ), (b)( 7 )(C) [ oak Ridge, NJ. 


UNDEVELPLED LEADS: AS PER INVESTIGATION 
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CASE NUMBER [ 

"TITLE P COMMERICAL CP WEBSITE KNOWN AS | (b)(6), (b)(7)(C) | 


TECS ACCESS CODE 


CASE STATUS: 


INTERIM RPT 


REPORT DATE 

DATE ASSIGNED 

PROGRAM CODE 

REPORT NO. 

102008 

060508 

E3 

004 


COLLATERAL REQ: 


TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 


TOPIC : INVESTIGATIVE UPDATE 


SYNOPSIS: 

This ROI £or record completion purpose only. 




1 (b)(7)(E) | 

| (b)(6), (b)(7)(C) I SENIOR SPEC AGENT 



APPROVED : 

| | SENIOR SPEC AGENT 

ORIGIN OFFICE: NK 
NEWARK, NJ - SAC 

TELEPHONE : 973 7 7l 1 

TYPIST: 1 (b)(6), (b)(7)(C) | 
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The ICE office of the Resident Agent in Charge Birmingham, Alabama (RAC/BI) , 
Cyber Crimes Center (C3) , along with the United States Postal Service, 

Federal Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ) , 
Child Exploitation and Obscenity Section (CEOS) , and the United States 
Attorney's Office (USAO) for the Northern District of Alabama are conducting 
an investigation in reference to Operation Flicker regarding the transmittal 
of monetary instruments from the sale of commercial child pornography website 
memberships. As a result, RAC/BI agents have working in conj unction with 
PayPal Inc. uncovered a PayPal account, I SSSS SEE i " i 3 that was 
allegedly created by I (b)(6), (b)(7)(C) | . Q f Wayne, NJ. This information was 

provided to the SAC/NK for further investigation. This ROI covers 
investigative activity for June, July, August and September 2008. 


DISTRIBUTION: 


| (b)(7)(E) | 

| (b>(6), (b)(7)(C) | SENIOR SPEC AGENT 



APPROVED : 

| (b)(6), (b)(7)(C) | SUP CRIM INVEST 

ORIGIN OFFICE: NK 
NEWARK, NJ - SAC 

TELEPHONE: 973 77P“ A IIP"I 

TYPIST: I (b)(6), (b)(7)(C) p 
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CASE PROGRAM CODES: 
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REPORT OF INVESTIGATION 


CONTINUATION 
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DETAILS OF INVESTIGATION: 


Information received from PayPal reveled that PayPal account, 

I SJ'X; «m"q% I. was created on Septe mber 18, 2007 using the I . P . address 
of | (ms) (b)(7)(C) [ . The address listed was I (b>(G> (b>(7xc> |, wayne , 


07470. The name associated with the PavPal account is I (b>(s>.(b)(7>(c>~ | . 

Investigation determined this address is a United Parc el Service. (UPS) 
mailbox etc store. Mail box number 161 is assigned to I (b>(6>,(b>(7>(c> | . 


a New Jersey State Police officer. The PayPal account had been upgraded 
from a personal account to a .^Tipe business associated with 

1 — 1 A check on the Internet 


the account was listed as 


concerning this company shows that the web site exists. The opening web page 

analysis) for the web 

Site I 6 6-01311 ^CldreSS 

given for the maintaine r of the web site is L j h 3 !£iI . The I.P. address 

given was I (b>(6) (b)(7)(C) ~| . 


Who is checks on the I.P. address I (b>(6> (b>(7)(c> | showed that the I.S.P. for 
this I.P. address is McColo Corporation, 64 East main st. box 275, Newark, 
De, 19715. 


Who is checks OH the Url htt-P; //qamemons terg.com reveled that the registrant 
is | (b)(6), (b)(7)(C) |, New york, New York, 11223 US 

Tel. | (b)(6) (b)(7)(C) | _ The registrant I.P. address is I ( b )(G> (b)(7)(C) ] and the 

ISP is McColo Corporation. 


Who is checks on the URL gpsoft.com reveled that the registrant is: 


(b)(6), (b)(7)(C) 
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(b>(6), (b)(7)(C) 


Further Pay Pal flat-. a on arrnnnf. I showed a customer service 

telephone number of | (b)(6), (b)(7)(C) | , which is the fax number for D ePaul Catholic 

High School, Wayne, NJ. Credit Card number I (b)(6), (b)(7)(C) | was linked to 

the PayPal account. This credit card was issued by Capital One bank. 
Information from Capital One Bank re veled that this credit card belongs to 
| (b)(6), (b)(7)(C) 1 . Wayne, NJ 07470. A review of purchases 

made on this credit card determined that approximately 80% of the purchases 
were for gasoline. The bill for the account is usually paid for over the 
Internet and account has a payment protection fee. 


Pay Pal data reveled that JPMorgan/ Chase bank account number I (b)(B),(b>(7)(c> | was 
linked to the account as the bank account. A check with JPMorgan/Chase 
revealed that there is no such bank account. 


On June 6, a Grand jury Subpoena was sent to Yahoo Inc, 
information on the e-mail address of 1(b)(3) is u s c § 35o&(^ c^d y^ms a 
Yahoo In c responded that the subscriber for L lu ' lJ '. louo,J 9 


for subscriber 
On Julv 9, 2008 
was Eg) 


twa) inn.sr. I 


. (b)(6) (b)(7)(c) [ The acco unt was created on September 18, 2007 using the I.P 
of I (b)(6), (b)(7)(C) | . (This is the same I.P. 


address as the one used to create the PayPal account). This I.P. address is 
assigned to COX.NET, Atlanta, Georgia. 


On July 21, 2008 a Grand jur y Subpoena wa s served on Cox.net for subscriber 
information on I.P. address I < b >< G > wnxci ~| , S eptember 18, 2007, for any 
subscriber information on I fbiiGijbiavo | or I (b)(6) ; (b)(7)(C) 1 . On July 28, 

2008 Cox.net r esponded to the subpoena request stating that the 
I (b)(6), (b)(7)(c) I , September 18, 2007 was too dated for any subscriber 
information and that Cox.net provides no I.S.P. service in New Jersey, 
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therefore they have no records on I (b>(6), (b)(7)(C) ~~] or T (b>(e>.(b>(7>(c> [ 7 


Investigation on I (b>(6>,(b)(7>(c> ~] revea led that he had previously used the 

e-mail address of I (b)(6), (b)(7)(c) | to subscribe to child pornography web 

sites . On July 9, 2008 AOL respond ed to subpoena request for subscriber 
information on I (b)(6), (b)(7)(c) I AOL response w as that this account w as 

t- p.rmi on 11-29-2004. The account belonged to | (b)(6), (b)(7)(c) ~| 

I (b)(6), (b)(7)(C) | ' Wayne, NJ 07470. 


UPS Mailbox 

] 


Investigation determined that I (b>(6>,(b>(7>(c> |, Wayne, NJ is a 

etc store. Box number 161 is owned/paid for by I (b>(6>,(b>(7>(c> 

I (b)(6), (b)(7)(C) I North Haledon . N , J . 07508. The teleohone numbers listed were 

973-8 d” J 1 (home). 973-97EES(work) . 9 7 3 - 97 P™1 - is dis connected . A 

Grand Jury Subpoena request f or toll records on 973 - 8 0^ 7^“'' I has been 
requested. E-mail address of I ( b >(6> (b)(7)(C) | i s associated with this 

address . 


On July 17, 2008 a Grand Jury subpoena was sent to America Online (AOL) for 
subscriber information on the e-mail address of I wmiQ I . On 

July 22, 2008 AOL respon de d that the subscribe r. fnr the . 

I (b)[6) (b)(7)(C) | is I (b)(6), (b)(7)(C) [ I (b)(6), (b)(7)(C) | Wayne, NJ 

07470. Evening phone nnmher of 074 - <n\'“’'Vr‘ "I . day nhone numher 973 -Bo r , T,° p7 l . 
Other screen names on the account are. 1 (b)(6) (b)(7)(C ) I . 

I (b)(6), (b)(7)(C) y 


On July 28, 2008 S/A I (b)(6) (b)(7)(c> | requested from National Center for 

Missing and Exploited Children (NCMEC) a technical assistance request on the 
e-mail addresses of: 


(b)(6), (b)(7)(C) 
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reveled that he used credit card number |_ 


(b)(6), (b)(7)(C) 


_| to make two 


subscription purchases of child pornography in 2001. This credit card was 
issued from PNC bank, Pittsburg, Pa. On August 8, 2008 a Grand Ju ry Subpoena 
was issued to PNC Bank for account information on I ( b >( B >. (b)(7)(C) I s . s . number 

(b)(6), (b)(7)(C) |, Qn August 19, 2008 PNC Ban k provided account statements for 

S . number 


(b)(6), (b)(7)(C) 


(b)(6), (b)(7)(C) 


a 


S . S . number 


(b)(6), (b)(7)(C) 


Th e account was open ed in the name of 

and | (b)(6), (b)(7)(C) | s . S . number 

Account statements are from July 2002 till July 2004 when it 

appears the account went into receivership. An analyst of the account showed 
ome purchases to likely adult pornography web sites . 


| (b)(6), (b)(7)(C) | usee 1 a second credit card, I (b)(6), (b)(7)(C) I. in 2001 to 

purchase a subscription to a child pornography web site. This credit card was 
issued by HSPC bank. Investigation revealed that this account went into 
default on 11-22-2004. Since then this account has been resold 5 times to 
various debt collection companies. No further information is available. 


t A third, credit card, | (b)(6), (b)(7)(C) |, was allegedly used by I (b>( t c ( f >|7 I 

| (b)(6), (b)(7)(C)] to make a purchase to child pornography web site. This credit card 
was allegedly issued by Columbus Bank. Columbus Bank reported that they have 
no record of issuing this credit card. 


On August 14, 2008 a Grand Jury subpoena was sent to the 3 main < 
reporting bureaus for current account information on | (b)(6), (b)(7)(C) 


redit 

1 


September 2, 2008 an an alysis of the in formation from, Equifax, E^perian, and 
Tran union reveled that I (b)(6) (b)(7)(C) ] had a current Sears/CBSD (Citibank 

South Dakota) credit card. On September 3, 2008 a Grand Jury Subpoe na was 
sent to citibank for account. Statements- Amo nn addresses niy en for I '"'TAT' I 


(b)(6), (b)(7)(C) | were 


Wayrp — Mil and 


(b)(6), (b)(7)(c) west Palm Beach. Florid a, 33420. The address of /r T ;b>(6> .(b)(7)(C) | 

H r West Palm Beach. Flo rida. r’T' 0 ”'] was allegedly in use August 2006. In 


August 2006 [_ ( b >( 6 >.( b >( 7 >( c ) |was in a New Jersey State Prison. The U.S. Postal 

Sery-i report that o wners for I (b)(6) (b)(7)[c> West Palm Beach, Fl orida 

are as follows: | (W), (b)(7)(C) |i 6/2005 12/2005 and | (b ( 7 ^ c ( > b> | 

4/2007 to 5/2008 . 


Internet research on | (b)(6), (b)(7)(c) | reveled he had an account with 
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(b>(6) (b>(7>(c> ' 0n Au 9 usfc 14 / 2008 a Grand Jury Subpoena was issued to 

for account information. On August 15, 2008 reunion.com responded 


that l~ (b)(6) (b)(7)(C) | had created two accou nts. The fi rst was on 7-12-2007 and 


the second was on 11-30- 2007. The DOB was | (b)(6) .(b)(7)(C) | and the e-mail address 
was | (b)(6).(b)(7)(c> ~| . A Grand Jury Subpoena was issued to Yahoo Inc on 

August 15, 2008 for subscriber information on | (b)(6), (b)(7)(c> | . on 

.B nmint 7ft — dnoft yahn p provided subscriber information on 

| (b)(6), (b)(7)(c) | . They report ed that this acc ount was created on Saturday 

March 31, 2007 in the name of Mr. | (b>(s> (b>(7>(c> ~| , Recent I.P. address show 

the following I.P. were used to connect to the Internet; 



Saturday 22 :47 : 37 (GMT) 08-09-2008 
Saturday 20:07:08 (GMT) 08-09-2008 
Friday 08:02:05 (GMT) 08-08-2008 
Sunday 20:53:11 (GMT) 08-03-2008 
Saturday 15:11:20 (GMT) 07-19-2008 
Wednesday 21:46:43 (GMT) 07-09-2008 
Saturday 16:09:56 (GMT) 06-28-2008 
Saturday 14:21:00 (GMT) 06-28-2008 
] Tuesday 08:31:35 (GMT) 06-24-2008 
Friday 09:50:09 (GMT) 06-20-2008 
Thursday 06:26:50 (GMT) 06-19-2008 


This I.P. is assigned to Verizon. A grand jury subpoena was sent to them for 
subscriber information on September 2, 2008. On September 5, 2008 Verizon 
reported that the subscriber for these I.P. address is: 

Business name- Unipack Inc 

Customer Name- | (b>(6> 5 (b>(7>(c> | 
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Account address- I (b)(6), (b)(7)(c) ~| 


Belleville, NJ 07109 


| (b)(6), (b)(7)(C) 1 

E-mail | (b)(6), (b)(7)(c) ~| 

-Addraaa. checks reveled that Unipack Inc. is located in Building #27. I tLJA 7A“ A '' I 
| (b)(6), (b)(7)(c)] works for Tomark Maintenance Co, which is located at 681 Main Street, 
Belleville, NJ, 07109 Building 29. 


| (b)(6). (b)(7)(C) | Tuesday 18:11:17 (GMT) 06-24-2008 

This I.P. is assigned to Optimum Online Cablevision Systems. On September 2, 
2008 a Grand Jury Subpoena was issued to Cablevision for subscriber 
information on this I.P. address. On September 16, 2008 Cablevision reported 
that this I.P. address is assigned to the Wayne Public Library, 475 Valley 
Rd, Wayne, NJ. 07470. 


Other I.P.s used to connect to the Internet come back to Panera Bread, 
sprint PCS, and N.J. State Library. 


UNDEVEVLOPED LEADS: AS PER INVESTIGATION. 
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001 

RELATED CASE NUMBERS: 


COLLATERAL REQ: 


TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 


TOPIC: CASE UPDATE 


SYNOPSIS : 

Project Flicker was developed in conjunction with the ICE Cyber Crimes Center, 
who generated several leads of subjects residing in the RAC Reno Area of 
Responsibility. These subjects used Pay pal online payment accounts to pay for 
child pornography found on previously identified web sites. 

The RAC/Reno will gather background information and conduct records checks on 
all subjects. In addition, interviews will be conducted to attempt to obtain 
consent to search computers at the subject's location. 

Investigation continues . 

RAC/Reno 
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TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 


TOPIC: CUSTOMS SUMMONS FAXED TO YAHOO TO OBTAIN ACCOUNT INFORMATION 


SYNOPSIS: 

Project Flicker was developed in conjunction with the ICE Cyber Crimes Center, 
who generated several leads of subjects residing in the RAC Reno Area of 
Responsibility. These subjects used Pay pal online payment accounts to pay for 
child pornography found on previously identified web sites. 


This Report of Investigation (ROI) details the submission of a Customs Summons 
to YAHOO on July 20, 2007. 
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On July 20, 2007, a Customs Summons was faxed to YAHOO to obtain all detailed 
billing, credit, and subscriber information (inclu ding IP logs) for the period 
of January 1, 2005 to July 17, 2007 related to the | (b>(6>,(b>(7>(c> j 

account , 

Investigation continues 
RAC/ Reno 
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SYNOPSIS; 

Project Flicker was developed in conjunction with the ICE Cyber Crimes Center, 
who generated several leads of subjects residing in the RAC Reno Area of 
Responsibility. These subjects used PayPal online payment accounts to pay for 
child pornography found on previously identified web sites. 


This Report of Investigation (ROI) details investigative activity to locate 
the physical addresses for Project Flicker subjects. 
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DETAILS OF INVESTIGATION: 


On August 7, 2007, information received from YAHOO indicated the email account 
a « soc i a t-. eri w ith a PayPal account identified by Project Flicker belonged to 
| (b)(6),(b)(7)(c) | Record s checks using Lexis Ne xis resulted in a possible physical 

address for I I at [ (b>(6>.(b>(7>(c> [ Reno, Nevada. 

On August 27, 2007, information received from t he Rockv Mo unt ain Informatio n 
Network (RMIN) provided a physical address for I (b>(B> ; (b)(7>(c> | a t | (b>(s>,(b>(7>(c> | , 

Incline Village, Nevada. 

Undeveloped Leads 

RAC/Reno 


OFFICIAL USE ONLY 

THIS DOCUMENT IS LOANED TO YOU FOR OFFICIAL USE ONLY AND REMAINS THE PROPERTY 
OF THE DEPARTMENT OF HOMELAND SECURITY, ICE. ANY FURTHER REQUEST FOR 
DISCLOSURE OF THIS DOCUMENT OR INFORMATION CONTAINED HEREIN SHOULD BE REFERRED 
TO ICE HEADQUARTERS TOGETHER WITH A COPY OF THE DOCUMENT. 


Page 620 of 929 




REQUESTED BY : | (bj 3, (b)(7)(C) | 

OFFICIAL USE ONLY 


DEPARTMENT OF HOMELAND SECURITY 
ICE 


REPORT OF INVESTIGATION 


TECS ACCESS CODE 


r 


PAGE 1 

CASE NUMBER I (b)(7)(E) I 


TITLE : OPERATION FLICKER 


CASE STATUS: 

INTERIM RPT 



REPORT DATE 

DATE ASSIGNED 

HI fcM 

REPORT NO. 

101107 

061207 

005 

RELATED CASE NUMBERS: 

COLLATERAL REQ: 

TYPE OF REPORT 




SUBPOENA SERVICE REPORT 



TOPIC: SUBMISSION OF CUSTOMS SUMMONS TO 

AT&T AND PAYPAL 



SYNOPSIS: 

Operation Flicker was developed in conjunction with the ICE Cyber Crimes 
Center, who generated several leads of subjects residing in the RAC Reno Area 
of Responsibility. These subjects used PayPal online payment accounts to pay 
for child pornography found on previously identified web sites. 


This Report of Investigation (ROI) details the submission of a Customs Summons 
to PayPal and AT&T. 
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DETAILS OF’ INVESTIGATION:' 


On September 21, 2007, a Customs Summons was faxed to PayPal to obtain records 
related to billing, credit transact ional, finan c ial account, and subs criber 
information (including IP logs) for | (b)(6). (b)(7)(C) | ( | (b>(B> : (b>(7>(c> | . 

On September 21, 2007, a Customs Summons was faxed to AT&T to obtain records 
related t o billing, cred it , .service, and sub scriber information (including IP 
logs) for | (b)(6), (b)(7)(c) I. I (b)(6), (b)(7)(C) | . Carson City, NV 89705. 

Undeveloped Leads 

RAC/Reno 
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TOPIC: NO NEW ACTIVITY IN LAST 30 DAYS 


SYNOPSIS: 

Operation Flicker was developed in conjunction with the ICE Cyber Crimes 
Center, who generated several leads of subjects residing in the RAC Reno Area 
of Responsibility. These subjects used PayPal online payment accounts to pay 
for child pornography found on previously identified web sites. 


No new activity in last 30 days. 
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Details of Investigation: 


On November 20, 2007, a Customs Summons was faxed to PayPal to obtain records 
related to billing, credit, transactions, financial account, and subscriber 
information (including IP logs) for the past two years related to the 
following accounts: 


(b)(3): 18 U.S.C. § 3509(d) Child victims' and child witnesses' 
rights,(b)(3):18 U.S.C. § 3509(d) (Federal Victims' Protection 
and Rights Act), (b)(8), (b)(7)(C) 


Undeveloped Leads 
RAC Reno 
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TOPIC: NO NEW ACTIVITY IN LAST 30 DAYS 
SYNOPSIS : 

Operation Flicker was developed in conjunction with the ICE Cyber Crimes 
Center, who generated several leads of subjects residing in the RAC Reno Area 
of Responsibility. These subjects used PayPal online payment accounts to pay 
for child pornography found on previously identified web sites. 

No new activity in last 30 days. 

Undeveloped Leads 
RAC Reno 
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TOPIC: NO NEW ACTIVITY 


SYNOPSIS : 

Operation Flicker was developed in conjunction with the ICE Cyber Crimes 
Center, who generated several leads of subjects residing in the RAC Reno Area 
of Responsibility. These subjects used PayPal online payment accounts to pay 
for child pornography found on previously identified web sites. 

No new activity since last Report of Investigation (ROI) . 


Undeveloped Leads 
RAC Reno 
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CASE NUMBER | (b)(7)(E) 


TITLE: OPERATION FLICKER 


CASE STATUS: INTERIM RPT 


REPORT DATE 
061008 


DATE ASSIGNED 
061207 


REPORT NO. 
017 


RELATED CASE NUMBERS: 


COLLATERAL REQ : 


TYPE OF REPORT: 
OTHER INFORMATION 


TOPIC: NO NEW ACTIVITY SINCE LAST REPORT OF INVESTIGATION 




SYNOPSIS : 

Operation Flicker was developed in conjunction with the ICE Cyber Crimes 
Center, who generated several leads of subjects residing in the RAC Reno Area 
of Responsibility. These subjects used PayPal online payment accounts to pay 
for child pornography found on previously identified web sites. 


No new activity since last Report of Investigation (ROI) . 


Undeveloped Leads 
RAC Reno 
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TITLE: OPERATION FLICKER 

CASE STATUS: 

INTERIM RPT 



REPORT DATE 

DATE ASSIGNED 

PROGRAM. CODE 

REPORT NO. 

082108 

061207 

| (b|7) j i 

020 

RELATED CASE NUMBERS: 


COLLATERAL REQ : 


TYPE OF REPORT : 
OTHER INFORMATION 


TOPIC: NO NEW ACTIVITY SINCE LAST REPORT OF INVESTIGATION 


SYNOPSIS : 


Operation Flicker was developed in conjunction with the ICE Cyber Crimes 
Center, who generated several leads of subjects residing in the RAC Reno Area 
of Responsibility. These subjects used PayPal online payment accounts to pay 
for child pornography found on previously identified web sites. 


No new activity since last Report of Investigation (ROI) . 

Undeveloped Leads 
RAC Reno 
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RELATED CASE NUMBERS : 


COLLATERAL REQ: 


TYPE OF REPORT: 
OTHER INFORMATION 


TOPIC: NO NEW ACTIVITY SINCE LAST REPORT OF INVESTIGATION 


SYNOPSIS: 

Operation Flicker was developed in conjunction with the ICE Cyber Crimes 
Center, who generated several leads of subjects residing in the RAC Reno Area 
of Responsibility. These subjects used PayPal online payment accounts to pay 
for child pornography found on previously identified web sites. 


No new activity since last Report of Investigation. 


Undeveloped leads 
RAC Reno 
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RELATED CASE NUMBERS: 


COLLATERAL REQ : 


TYPE OF REPORT: 
OTHER INFORMATION 


TOPIC: NO NEW ACTIVITY 


SYNOPSIS: 

Operation Flicker was developed in conjunction with the ICE Cyber Crimes 
Center, who generated several leads of subjects residing in the RAC Reno Area 
of Responsibility. These subjects used PayPal online payment accounts to pay 
for child pornography found on previously identified web sites. 

No new activity since last Report of Investigation. 

Undeveloped leads 
RAC Reno 
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RELATED CASE NUMBERS: 


COLLATERAL REQ : 


TYPE OF REPORT: 
OTHER INFORMATION 


TOPIC: NO NEW ACTIVITY SINCE LAST REPORT OF INVESTIGATION 


SYNOPSIS: 

Operation Flicker was developed in conjunction with the ICE Cyber Crimes 
Center, who generated several leads of subjects residing in the RAC Reno Area 
of Responsibility. These subjects used PayPal online payment accounts to pay 
for child pornography found on previously identified web sites. 

No new activity since last Report of Investigation. 


Undeveloped leads 
RAC Reno 
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RELATED CASE NUMBERS: 


COLLATERAL REQ: 


TYPE OF REPORT: 
OTHER INFORMATION 


TOPIC: NO NEW ACTIVITY SINCE LAST REPORT OF INVESTIGATION 


SYNOPSIS: 

Operation Flicker was developed in conjunction with the ICE Cyber Crimes 
Center, who generated several leads of subjects residing in the RAC Reno Area 
of Responsibility. These subjects used PayPal online payment accounts to pay 
for child pornography found on previously identified web sites. 


No new activity s 

Undeveloped leads 
RAC Reno 


fet Report of Investigation. 
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REPORT NO. 

011409 

061207 

ra 

025 

RELATED CASE NUMBERS: 

COLLATERAL REQ: 

TYPE OF REPORT 




OTHER INFORMATION 



TOPIC: NO NEW ACTIVITY SINCE LAST REPORT OF INVESTIGATION 


SYNOPSIS : 

Operation Flicker was developed in conjunction with the ICE Cyber Crimes 
Center, who generated several leads of subjects residing in the RAC Reno Area 
of Responsibility. These subjects used PayPal online payment accounts to pay 
for child pornography found on previously identified web sites. 

No new activity since last Report of Investigation. 


Undeveloped leads 
RAC Reno 
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TITLE: PROJECT FLICKER/ RAC ALBUQUERQUE 


CASE STATUS: 

CLOSING RPT 



REPORT DATE 
062308 

DATE ASSIGNED 
061407 

PROGRAM CODE 

\ \ 

|MBJ 

REPORT NO. 
008 

RELATED CASE NUMBERS: | 

(b)(7)(E) 

l 





COLLATERAL REQ: 


TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 


I 


TOPIC: FORWARDED LEADS TO NMSP/CASE~ CLOSING 


SYNOPSIS : 

In April 2006, the Immigration and Customs Enforcement (ICE) , Cyber Crimes 
Center (C3) , Child Exploitation Section (CES) , initiated an investigation into 
a c r im | h^Ji, j^r gao t ion operating a commercial child pornography website known 
as ' I victims' and* child ^tnaMM 1 SS». I " The investigation revealed that the same organization 
was operating numerous commercial child pornography websites. In addition, 
the organization utilizes various PayPal accounts to process the payments for 
access to the member restricted websites. 

This Report of Investigation will detail the information provided to the New 
Mexico State Police, Criminal Investigation Division, on April ll, 2008. 
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REPORT NUMBER: 008 


DETAILS OF INVESTIGATION 


In April 2006, the Immigration and Customs Enforcement (ICE), Cyber Crimes 
Center (C3) , Child Exploitation Section (CES) , initiated an investigation into 
a c riminal organizat ion operating a commercial child pornography website known 
as inn £iirt witn^Ti nnh^ I - " The investigation revealed that the same organization 

was operating numerous commercial child pornography websites. In addition, 
the organization utilizes various PayPal accounts to process the payments for 
access to the member restricted websites . 

ICE, Resident Agent in Charge Albuquerque, NM (RAC/AL) conducted database 

inquires into indi viduals associ ated with Project i cker rrn An-H 1 i_L, 2 008, 

Special Agent (SA) I (b)(6), (b)(7)(C) | provided Sergeant (SGT) I (b><s>.(b>(7>(c> | Q f the 

New Mexico State Police, Criminal Investigation Division, with several 
ind ividual s suspected of purcha sing access to this child pornography website. 
SA | www'" | provided SGT I < b » 6 >t b >(7>(C) | with a Microsoft Excel spreadsheet containing 
information on the following individuals: 


Name Location 


(b)(6), (b)(7)(C) 

Aztec, NM 
Tucumcari , NM 
Gallup, NM 
Chimayo , NM 
Gallup, NM 
Zuni , NM 
Santa Fe, NM 
Albuaueroue, NM 

| (b>(6>, (b)(7)(C) | a 1 hi in ue roue. NM 

| (b)(6), (b)(7)(C) | 

Edgewood, NM 


The New Mexico State Police, Criminal Investigations Division will attempt to 
determine each individual's level of involvement in child pornography. 

RAC/AL has completed several interviews and investigations pertaining to 
individuals associated with Project Flicker. Below are the names, locations, 
and results of completed investigations: 

LocationResults 


Albuquerque, NM Refer to 
Albuquerque, NM Refer to 
Santa Fe, NM Revoked consent to search 
Albuquerque, NM Moved to unknown location 
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Santa Fe, NM Refused to speak to agents 


Santa Fe, NM Refused to s peak to agents 
Albuquerque, NM Refer to 1 fb ‘': 7 ^E. 

Albuquerque, NM Several attempts made, unable to 
Locate 

Albuquerque, NM Consented to search, no evidence 
discovered on computer 

Albuquerque, NM Consented to search, no evidence 
discovered on computer 

Albuquerque, NM Consented to search, no evidence 

discovered on com puter 

Albuquerque, NM Refer to I ~~l 

Albuquerque, NM Consented to search, no evidence 
discovered on computer 

Santa Fe, NM Arrested by Arizona auth orities 
Santa Fe, NM Refer to I lbl(7ilEl 1 
Albuquerque, NM Follow up conducted by NMSP 
Albuquerque, NM Arrested by NM Probation 


All individuals pertaining to Operation Flicker within the RAC/AL area of 
operation have been addressed or referred to NMSP. This case will be 
considered closed. 0 
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SYNOPSIS: 

This Child Pornography and Exploitation case will serve as the umbrella case 
for the Office of the Resident Agent in Charge, San Francisco International 
Airport (RAC/SI) to incorporate general investigative and enforcement 
activities involving child sexual exploitation, internet and cyber crimes 
against children, leads from other law enforcement entities, locating and 
apprehending aliens with criminal convictions for sexual offenses against 
children, and other crimes involving the sexual abuse of children are examples 
of the types of activities that will be annotated under this case heading. 

This case will include developing and undeveloped le ads from Operatino Falcon 
( I (b)(7)(E) |) ( operation Predator ( I wxe) | ) , Operation Emissary and 

Emissary II, and Operation Watchdog. This case will remain open for Fiscal 
Year 2007. 


This report will serve as the closing ROI for this case. 
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DETAILS OF “INVESTIGATION 


This Child Pornography and Exploitation case will serve as the umbrella case 
for the Office of the Resident Agent in Charge, San Francisco International 
Airport {RAC/SI} to incorporate general investigative and enforcement 
activities involving child sexual exploitation, internet and cyber crimes 
against children, leads from other law enforcement entities, locating and 
apprehending aliens with criminal convictions for sexual offenses against 
children, and other crimes involving the sexual abuse of children are examples 
of the types of activities that will be annotated under this case heading. 

This case will include developing and undeveloped lea ds from Operatino Falcon 
( I (b)(7)(E) 1 ) , Operation Predator ( I (b)(7)(E) 1 ) , Operation Emissary and 

Emissary II, and Operation Watchdog. This case will remain open for Fiscal 
Year 2007. 

All remaining lead information and targets from this case will be annotate d 
under the the RAC/SI s CHILD PORNOGRAPHY AND EXPLOITATION < 1 mmiB I ) 
Fiscal Year 2008 umbrella case. 

All property under the FY 2007 case has been assigned its final disposition. 
Case Closed. 
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TITLE: OPERATION FLICKER-RAC/LONG ISLAND 

CASE STATUS: 

INIT RPT 



REPORT DATE 
070907 

1 DATE ASSIGNED 

070907 

PROGRAM CODE ] 

1 

REPORT NO. 
001 


RELATED CASE NUMBERS: 


COLLATERAL REQ: 


TYPE OF REPORT: 
OTHER INFORMATION 


TOPIC: OPERATION FLICKER- -RAC/LI TARGETS 
SYNOPSIS: 


This case file number and title will serve as the catchall for Operation 
Flicker targets that are under investigation but not forwarded to the EDNY for 
federal prosecution by the ICE RAC/Long Island Office. These will include but 
not be limited to, negative computer searches as a result of knock and talks, 
denial of permission to conduct consent searches and investigative inquiries 
that indicate no further investigative action is required. Each target that 
falls into these categories will have an open and close ROI written against it 
with this RAC/Long Island Operation Flicker case number. 


If an Operation Flicker target is accepted for federal prosecution a separate 
case file will be created by the case agent. 


Details follow. 


DISTRIBUTION: 
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REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: 001 


DETAILS OF INVESTIGATION: 


The 36 individuals listed on the following pages were identified through 
Operation Flicker as having subscribed to Internet web sites that contained 
child pornography. These individuals currently reside within the RAC/Long 
Island area of responsibility. 

There is an Operation Flicker spreadsheet available which details the full 
amount of information for each of the targets listed below. 


NAME 


(b)(3), (b)(7)(C) 


CITY 
Miller Place 
Southampton 
Commack 
Bayshore 

Copiague 245 

Bellmore 256 

Commack 389 

Levittown 399 

Long Beach 422 

Commack 461 

Sayville 488 

Elmont 494 

E. Rockaway 564 

Selden 592 

Bellmore 595 

Bellmore 601 

Sayville 606 

Huntington 618 

Garden City 637 

Holbrook658 
Hicksville669 
Massapequa PK714 
Bellmore? 15 
Massapequa724 
Selden748 
Riverhead772 
Commack789 
Wantagh790 
Westbury791 
Hauppauge798 
Pt. Washington804 
Centereach855 

Hicksville859 
Franklin Square861 


SPREAD SHEET NO. 
108 
111 
158 
243 
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mmwm ^len Cove »l « 

CentereachS 8 8 
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CASE 

NUMBER | (b)(7)(E) | 


TITLE: OPERATION FLICKER-RAC/LONG ISLAND 


CASE STATUS: INTERIM RPT 


REPORT DATE 

DATE ASSIGNED 

PROGRAM CODE 

REPORT NO. 

012508 

070907 

ra 

007 


RELATED CASE NUMBERS: 


COLLATERAL REQ : 


TYPE OF REPORT; 
OTHER INFORMATION 


TOPIC: OPERATION FLICKER TARGETS TOT SCPD 


SYNOPSIS: ' 

At the direction of AUSA I (b)(6), (b)(7)(C) | Q f the EDNY, Central Islip, a number of 

Operation Flicker child pornography targets are being turned over to the 
Suffolk County Police Department Computer Crimes Squad for investigation. 

SCPD Computer Crimes is a law enforcement member of the federal Crimes Against 
Children Task Force overseen by the US Attorneys Office. 


DETAILS OF INVESTIGATION: 


DISTRIBUTION: 
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On January 22, 2008, AUSA I we), (b)(7)(c) | advised the reporting agent that a number 
of the Operation Flicker child pornography targets residing in Suffolk County 
could be turned over to the Suffolk County Police Department Computer Crimes 
Squad for investigation/knock and talk interviews. 


On January 24, 2008, the reporting agent met with Detective | (b)(6), (b)(7)(c) ~| of 

the SCPD Computer Crimes Unit and turned over ten (10) Operation Flicker 
files . 
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CASE STATUS: 

CLOSING RPT 



REPORT DATE 

DATE ASSIGNED 

PROGRAM CODE 

REPORT NO. 

022609 

070907 

LSI 

008 


RELATED CASE NUMBERS: 


COLLATERAL REQ: 


TYPE OF REPORT: 
OTHER INFORMATION 


TOPIC: CLOSING ROI 


SYNOPSIS: 

This case will serve as a catch all for Operation Flicker targets that are 
under investigation but not forwarded to the EDNY for federal prosecution by 
the ICE RAC/Long Island office. 


If an Operation flicker target is accepted for federal prosecution, a separate 
case file will be created by the case agent. 
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CONTINUATION 
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All targets have been assigned to individual agents and/or forwarded to the 


Suffolk County Police Department Computer Crimes Squad for investigation. The 
information gathered in Operation Flicker has been exhausted and is aged by 
three or more years. Any further "Operation Flicker" referrals or ROI 1 s will 
be contained in either the Nassau or Suffolk Operation Predator case folders. 
This ROI will close this Operation Flicker case folder. 
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CASE 

NUMBER 1 (b)(7)(E) 1 


TITLE: COMMERICAL CP WEBSITE KNOWN AS ESSSSST 


CASE STATUS: 

INIT RPT 



REPORT DATE 

DATE ASSIGNED 

PROGRAM CODE 1 

REPORT NO. 

092407 

082107 


001 


RELATED CASE NUMBERS : | (b)(7)(E) | 


COLLATERAL REQ : 


TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 


TOPIC: COLLATERAL INVESTIGATION FOR PROJECT FLICKER 


SYNOPSIS : 

In April 2006, the United States Immigration and Customs Enforcement, Cyber 
Crimes Center, Child Exploitation Section, initiated an investigation into a 
r. r i mi A on operating a commercial child pornography website known 

as LainS' and'dilid lilneslel nahtJ . The investigation has revealed the organization is 
operating numerous commercial child pornography websites. Various PayPal 
accounts to process the payments for access to the member-restricted webs ites 
have been identified. A joint investigation titled Project Flicker OO has 
sent a collateral request to RAC/Corpus Christ i for investigation to 
substantiate the potential leads within RAC/CC's AOR developed by Project 
Flicker . 

This Report of Investigation documents the investigation conducted by 
RAC/Corpus Christi agents . 
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SIGNATURE: 
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REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: 001 


DETAILS OF INVESTIGATION: 

Currently RAC/CC Senior Intelligence Research Specialist John Schleider is 
gathering information to determine if the involved individuals are still 
residing at their listed addresses. RAC/CC is also conducting criminal 
history checks and searching the Texas Department of Public Safety Sexual 
Offender Database to determine if any of the listed individuals are convicted 
of any sexual offenses. 

The suspect information is as follows : 

I (b)(6), (b)(7)(C) I Corpus Christ! , 

TX”75'4TS 

| (b)(6), (b)(7)(C) j. corpus Christi, TX 

78404 

I (jjj(6Mbj 7) :> | , Corpus Christi, TX 

78413 

I ibuG.:.,) | , Corpus Christi, TX 

78418 

I .bus) a,); ■,:>;■ | . Corpus Christi, TX 

78401 

I <b)(G) (b)(7)(C) I , Corpus Christi, TX 78418 

I <b»G) (b)(7)(C) I , Corpus Christi, TX 78418 


I _ (b)(G) (b)(7)(C) 1 , Edna , TX 

77957 

| (b)(6) (b)(7)(C) | , Ingleside, TX 78362 

Investigation continues. 


OFFICIAL USE ONLY 

THIS DOCUMENT IS LOANED TO YOU FOR OFFICIAL USE ONLY AND REMAINS THE PROPERTY 
OF THE DEPARTMENT OF HOMELAND SECURITY, ICE. ANY FURTHER REQUEST FOR 
DISCLOSURE OF THIS DOCUMENT OR INFORMATION CONTAINED HEREIN SHOULD BE REFERRED 
TO ICE HEADQUARTERS TOGETHER WITH A COPY OF THE DOCUMENT. 


Page 667 of 929 




REQUESTED BY : I :: ( b >( 7; := | 

OFFICIAL USE ONLY 


DEPARTMENT 

OF 

HOMELAND SECURITY 
ICE 

TECS 

ACCESS CODE yj 

PORT OF 

I 

NVESTIGATION 

PAGE 

1 




CASE 

NUMBER | (b)(7)(E) f 


TITLE : COMMERICAL CP WEBSITE KNOWN T 

CASE STATUS: INTERIM RPT 


REPORT DATE 

DATE ASSIGNED 

PROGRAM CODE 

REPORT NO. 

010708 

082107 

761 

002 


RELATED CASE NUMBERS" 


| (b)(7)(E) 

COLLATERAL REQ: 


TYPE OF REPORT: 

INVESTIGATIVE FINDINGS 

I 


TOPIC: DISTRIBUTION OF PROJECT FLICKER LEADS 


SYNOPSIS: 

In April 2006, the United States Immigration and Customs Enforcement, Cyber 
Crimes Center, Child Exploitation Section, initiated an investigation into a 
criminal organization operating a commercial child pornography website known 
as Home Collection. The investigation has revealed the organization is 
operating numerous commercial child pornography websites. Various PayPal 
accounts to process the payments for access to the member -restricted webs ites 
have been identified. A joint investigation titled Project Flicker QQ has 
sent a collateral request to RAC/Corpus Christi for investigation to 
substantiate the potential leads within RAC/CC's AOR developed by Project 
Flicker . 


This Report of Investigation documents the continuing investigation by the 
RAC/Corpus Christi. 


DISTRIBUTION : 

SIGNATURE ; . 

1 (b)(7)(E) | 

1 1 SPECIAL AGENT 
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1 1 OI GRP SUPERVISOR 
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CASE 

NUMBER | 

(b)(7)(E) r 


REPORT NUMBER: 002 


Details of Investigation: 


In April 2006, the United States Immigration and Customs Enforcement, Cyber 
Crimes Center, Child Exploitation Section, initiated an investigation into a 
cr iminal organizat ion operating a commercial child pornography website known 
_ „ | tBTrJVTSTrSTTK S5uy d Child I . . , , , 3 c . 

as Ivirtimq' rt nhiTri rinh t d . The inves t igation has revealed the organization is 
operating numerous commercial child pornography websites. Various PayPal 
accounts to process the payments for access to the member-restricted websites 
have been identified in the RAC/Corpus Christi* s Area of Responsibility. 

In October 2007, nine leads received from this Collateral Investigation 
Request to the RAC/Corpus Christi were distributed among six agents, and are 
listed as follows: 


Case Number: 

I (b)(7)(E) I 


Case Aqent : IZ 

(b)(6), (b)(7)(C) | 



(b)(6), (b)(7)(C) 


TX 78412 



Case Number: 

' w™ . ' 


Case Aqent: \ 

(b)(6), (b)(7)(C) | 



(b)(6), (b)(7)(C) 

1. Edna, TX 

77957 



Case Number: 

1 (b)(7)(E) | 


Case Aqent : L 

(b)(6), (b)(7)(C) | 


r — 

(b)(6), (b)(7)(C) 

1. CorDUS Christi, TX 

78413 



Case Number: 

| (b)(7)(E) | 


Case Aqent : T 

(b)(6), (b)(7)(C) || 


i 

(b)(6), (b)(7)(C) 

1. Inaleside. TX 78362 

Case Number: 

1 (b)(7)(E) | 


Case Aqent: C 

(b)(6), (b)(7)(C) | 



(b)(6), (b)(7)(C) 

I, Corpus Christi, TX 78418 

Case Number; 

1 (b)(7)(E) | 


Case Aqent : E 

(b») (b)(7)(C) | 


i — 

(b)(6), (b)(7)(C) 

1. CorDUS Christi, TX 78418 

Case Number: 

1 (b)(7)(E) | 


racsp Arrant- • T 

(b)(6), (b)(7)(C) | 



(b)(6), (b)(7)(C) 

I, Corpus Christi, TX 


78401 
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CONTINUATION 

REPORT NUMBER: 002 



(b)(6), (b)(7)(C) | 



(b)(6), (b)(7)(C) 

|, Corpus Christi, TX 

78404 



Case Number: T 

(b)(7)(E) | 



(b)(6), (b)(7)(C) 

1, Corpus Christi, TX 


78418 


RAC/CC Senior Intelligence Research Specialist I (b>(s> (b>(7>(c> | gathered 

information determining the involved individuals are still residing at their 




databases 1 

(b)(7)(E) | 


Investigation continues. 
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CASE 

NUMBER | (b)(7)(E) | 


TITLE: COMMERICAL CP WEBSITE KNOWN AS [S and Besses- riows t 


CASE STATUS: INTERIM RPT 


REPORT DATE 

DATE ASSIGNED 

PROGRAM CODE 

REPORT NO. 

012009 

082107 

ra 

003 


RELATED CASE NUMBERS: 


COLLATERAL REQ: 


TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 


TOPIC: UPDATE OF PROJECT FLICKER INVESTIGATIONS 


SYNOPSIS: 

In April 2006, the United States Immigration and Customs Enforcement, Cyber 
Crimes Center, Child Exploitation Section, initiated an investigation into a 
criminal organization operating a commercial child pornography website known 
as Home Collection. The investigation has revealed the organization is 
operating numerous commercial child pornography websites . Various PayPal 
accounts to process the payments for access to the member-restricted webs ites 
have been identified. A joint investigation titled Project Flicker (j^J has 
sent a collateral request to RAC/Corpus Christi for investigation to 
substantiate the potential leads within RAC/CC's AOR developed by Project 
Flicker. 

This Report of Investigation documents the continuing investigation by the 
RAC/Corpus Christi. 


nTRTRTRtlTTOB: 

SIGNATURE: 

| (b)(7)(E) 1 

| (b)(6), (b)(7)(C) I SPECIAL agent 



APPROVED : 
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Details of Investigation: 


In April 2006, the United States Immigration and Customs Enforcement, Cyber 
Crimes Center, Child Exploitation Section, initiated an investigation into a 
criminal organization operating a commercial child pornography website known 
as Home Collection. The investigation has revealed the organization is 
operating numerous commercial child pornography websites. Various PayPal 
accounts to process the payments for access to the member-restricted websites 
have been identified in the RAC/Corpus Christi's Area of Responsibility. 

In October 2007, nine leads received from this Collateral Investigation 
Request to the RAC/Corpus Christi were distributed among six agents, and are 
listed as follows: 


J, Corpus Christi, 


| (b)(6), (b)(7)(C) | was arrested on May 15, 2008 and sentenced to 60 in the custody of 

the Bureau of Prisons on November 25, 2008. 



, Corpus Christi, TX 

78413 

A search warrant was served on I (b)(6), (b)(7)(C) | residence on November 4, 2008. An 

arrest warrant will be filed pending the return of forensic analysis from 
NCMEC . 


, Ingleside, TX 78362 
October 17, 2008. An 
arrest warrant will be filed pending the return of forensic analysis from 
NCMEC . 
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I I ry-'Y-r-mq Chgj-SttJ TV 

(b)(7)(E) 


PAGE 4 

CASE NUMBER | (b)(7)(E) j 

REPORT NUMBER: 003 


Case Number: 

1 (b)(7)(E) | 






(b)(6), (b)(7)(C) 

1 Corpus Chrisit, TX 78418 

The case was 

closed because it was discovered r u "7A“"' 

j had left the country. 

However. l wl 7A Dn ''l returned to 1 (b)(6), (b)(7)(C) |, and the 

case was reopened under 

case number: 

| (b)(7)(E) |. 

Case Number: 

| (b)(7)(E) | 


Case Aqent: [ 

(b)(6), (b)(7)(C) | 


i : 

(b)(6), (b)(7)(C) 

1, Corpus Christi, TX 

78401 

All investigative leads were exhausted; therefore the case was closed. 

Case Aqent : L 

(b)(6), (b)(7)(C) | 


i ■■■ 

(b)(6), (b)(7)(C) 

I. Corpus Christi, TX 


■784 04 

(b)(7)(E) 


Case Number : I (b)(7)(E) ~ 

.Case Agent.; I (b > (G > (b > (7 > (C > 

I (b)(6), (b)(7)(C) |, Corpus Christi, TX 

.78418 . 

(b)(7)(E) 


RAC/CC Senior Intelligence Research Specialist I ib>(6> (b>(7xc> | gathered 

information determining the involved individuals are still residing at their 
listed addresses. R AC/CC agents have also conducted queries on nume rous 
databases as well as I (b)(7)(E) | . 

Investigation continues. 
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004 


RELATED CASE NUMBERS: 



COLLATERAL REQ: 


TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 


TOPIC; SYNOPSIS OF ON-GOING INVESTIGATIONS FOR ALL TARGETS 


SYNOPSIS : 

In April 2006, the United States Immigration and Customs Enforcement, Cyber 
Crimes Center, Child Exploitation Section, initiated an investigation into a 
criminal organization operating a commercial child pornography website known 
as Home Collection. The investigation has revealed the organization is 
operating numerous commercial child pornography websites. Various PayPal 
accounts to process the payments for access to the member- restricted web sites 
have been identified. A joint investigation titled Project Flicker (I T ' ' ’ l has 
sent a collateral request to ASAC/Corpus Christi for investigation to 
substantiate the potential leads within ASAC/CC's AOR developed by Project 
Flicker. 


This report of investigation documents the investigations conducted by 
ASAC/Corpus Christi agents. 


DISTRIBUTION: 

SIGNATURE: ■ 

| (b)(7)(E) 1 

| (b)(6>.(b>(7MC) | SPECIAL AGENT 
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CONTINUATION 

REPORT NUMBER: 004 


DETAILS OF INVESTIGATION: 

At this time, three of the targets listed have been sentenced and two targets 
have been indicted. All other targets are still under investigation and 
search warrants are pending. 

Investigation continues. 


OFFICIAL USE ONLY 

THIS DOCUMENT IS LOANED TO YOU FOR OFFICIAL USE ONLY AND REMAINS THE PROPERTY 
OF THE DEPARTMENT OF HOMELAND SECURITY, ICE. ANY FURTHER REQUEST FOR 
DISCLOSURE OF THIS DOCUMENT OR INFORMATION CONTAINED HEREIN SHOULD BE REFERRED 
TO ICE HEADQUARTERS TOGETHER WITH A COPY OF THE DOCUMENT. 


Page 678 of 929 




REQUESTED BY : I jbjgjji I 

OFFICIAL USE ONLY 



In April 2006, the United States Homeland Security Investigations, Cyber 
Crimes Center, Child Exploitation Section, initiated an investigation into a 
criminal organization operating a commercial child pornography website known 
as Home Collection. The investigation has revealed the organization is 
operating numerous commercial child pornography websites. Various PayPal 
accounts to process the payments for access to the member- restricted webs ites 
have been identified. A joint investigation titled Project Flicker d ; \ has 
sent a collateral request to ASAC/Corpus Christi for investigation to 
substantiate the potential leads within ASAC/CC's AOR developed by Project 
Flicker. 

This Report of Investigation documents the investigation conducted by 
ASAC/Corpus Christi agents. All investigative leads have been exhausted 
therefore this case is closed. 


DISTRIBUTION: 

SIGNATURE: 

1 (b)(7)(E) | 

| (b)(6), (b)(7)(C) | SPECIAL AGENT 



APPROVED: 
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DETAILS OF INVESTIGATION: 

In April 2006, the United States Homeland Security Investigations, Cyber 
Crimes Center, Child Exploitation Section, initiated an investigation into a 
cri minal organizati on operating a commercial child pornography website known 
as U ^ The investigation has revealed the organization is 
operating numerous commercial child pornography websites . Various PayPal 
accounts to process the payments for access to the member- restricted webs ites 
have been identified. A joint investigation titled Project Flicker d ^ } has 
sent a collateral request to ASAC/Corpus Christi for investigation to 
substantiate the potential leads within ASAC/CC's AOR developed by Project 
Flicker. 

ASAC/Corpus Christi HSI Agents determined I (bxs> (b>(7)(c> | i S currently residing 

in Atlanta, GA. Corpus Christi agents sent a collateral request £or further 
investigation. 

ASAC/Corpus Christi HSI Agents determined I (b>(G> (b>(7>(0) | i s currently residing 

in Knoxville, Tennessee. Corpus Christi agents sent a collateral request for 
further investigation. 

I (b)(3), (b)(7)(C) ] w as sentenced to 12 0 months in the custody of the Bureau of 

Prisons . 

| (b)(6), (b)(7)(C) | was sentenced to 51 months in the custody of the Bureau of 

Prisons . 

I (b)(6), (b)(7)(c) | was sentenced to 60 months in the custody of the Bureau of Prisons. 

| (b)(6>, (b)(7)(C) | v;as sentenced to 240 months in the custody of the Bureau of 

Prisons . 

1 (b)(6) (b)(7)(c) ~| was sentenced to 120 months in the custody of the Bureau of 

Prisons . 

AUSA | (b)(6), (b>(7>(C) | declined prosecution of I (b>(B> (b)(7)(c> | . The case was referred 

to the District Attorney's office for prosecution. * 

All investigative leads have been exhausted; therefore this case is closed. 
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TITLE: PROJECT FLICKER 
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PAGE 
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CASE 

NUMBER | 

(b)(7)(E) | 


CASE STATUS: 

INTERIM RPT 



REPORT DATE 

DATE ASSIGNED 

PROGRAM CODE 

REPORT NO. 

100507 

071707 

1^1 

002 

RELATED CASE NUMBERS: 

COLLATERAL REQ: 

TYPE OF REPORT 




OTHER INFORMATION 



TOPIC: INDIVIDUAL CASES OPENED FOR EACH 

TARGET 



SYNOPSIS: 

The ICE SAC San Juan received information from the ICE Cyber Crimes Center 
(C3) regarding an investigation into individuals who purchased access to 
websites containing child pornography. Four individuals from Puerto Rico have 
been identified as possible suspects in the investigation. The SAC San Juan 
is investigating this matter to identify the suspects and determine their 
involvement in child pornography. 


Results from Grand Jury subpoenas previously served have been received and 
additional subpoenas requesting further information are being served. 
Individual cases are being opened for each of the four targets in Puerto Rico. 
Details of the information obtained and status of each investigation will be 
documented in the corresponding individual cases. This case will continue to 
monitor general investigative activity related to the operation in Puerto 
Rico. This investigation continues. 


DISTRIBUTION: 
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1 | SPECIAL AGENT 



APPROVED : 

| (b}(6>, (b)(7)(C) | OI GRP SUPERVISOR 
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SYNOPSIS : 

The Resident Agent in Charge (RAC) Boise, Idaho received information derived 
from "Operation Flicker" relating to the distribution of child pornography 
through the Internet. In April 2006, Immigration and Customs Enforcement's 
Cyber Crimes Center, Child Exploitation Section initiated an investigation 
into a cri minal organizat ion operating a commercial child pornography website 
known as iTH . 11 The investigation has revealed that the same 

organization is operating numerous commercial child pornography websites which 
utilize PayPal accounts to process the payments for access to the member 
restricted websites. This case serves as an umbrella case for all of the 
Operation Flicker suspects that reside in the RAC Boise area of 
responsibility. 


RAC Boise is gathering identifying data and conducting background 
investigations on each of the fifteen targets identified as residing in the 
RAC Boise AOR . Detailed information on each target to follow. 


DISTRIBUTION: 

SIGNATURE: 
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. APPROVED: 
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DATE ASSIGNED PROGRAM. CODE 

090607 

REPORT NO. 
001 

RELATED CASE NUMBERS: 


COLLATERAL REQ 



TYPE OF REPORT 




[ INVESTIGATIVE FINDINGS 

TOPIC: INVESTIGATIVE FINDINGS ON OPERATION FLICKER - RI POTENTIAL VIOLATORS 
______ 

SYNOPSIS : 

RAC / Providence i3 initiating an investigation in concert with Operation 
Flicker. This investigation has revealed that there are potentially sixteen 
violators in the Rhode Island area. RAC Providence will work in concert with 
other law enforcement in Rhode Island to determine if these persons are 
involved in the transmission of child pornography. 

This Report of Investigation will identify the information gathered from 
Accurint and Autotrack and NCIC Criminal History results on the sixteen 
potential violators in the Rhode Island area. 
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C 0 N T 
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REPORT NUMBER: 001 


DETAILS OF INVESTIGATION: 

Information gathered from Accurint and Autotrack on Operation Flicker's 
sixteen possible violators in Rhode Island is identified below. in addition 
to Accurint, and Autotrack, NCIC Criminal History results are also identified. 



Telephone Number: 401-32L. 
NCIC: No identifiable record 


terly, RI 02891 


| (b)(6 Hbl(7)tq | 

DOB : (b)(6), (b)(7)(C) 

SSN: ___J 

Address: I om. (b)(7)(C) |, Cranston, RI 02910 

2nd Address: | (b)(6), (b)(7)(C) [ Cranston, RI 02905 

Telephone Number : 4 01-94| wl ° ( , ( | ; l “ M,, | 

NCIC: No identifiable record 


DOB: 

SSN: 

Address : |_ 


Telephone Number: 401- 
NCIC: Positive 
FBI Number : | W»,TO |.) | 


Coventry, RI 02816 


□ 


State Identification Number: 


| (b)(6), (b)(7)(C) | 

DOB: 

SSN: 

(b)(6), (b)(7)(C) 



AriHrfWfl. I (b)(6) (b)(7)(C) | Woonsocket, RI 02895 

Telephone Number: 4 01-76 | W( 7c° n/) l 
NCIC: No identifiable record 


C 


DOB 

SSN: 


(b)(6), (b)(7)(C) 


Address : [ 


], Johnston, RI 02919 
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NCIC: Positive 

FBI Number : T™ B> mia U> ' P> I 

State Identification Number: [ 


| (b)( G> (b)(7)(C) | 

SSN • (b)(6), (b)(7)(C) 

Address; I (b>(e>.( b )(7>(c> ~] Rive raide. RI 02915 

Telephone Number: 4 01-4 j w 7A b>|,) I 
NCIC: No identifiable record 


(b)(6),(b)(7)(C) 


1, Fos ter. RI 02825 


OOB: (b>( 

SSN: | 

Address : 

Te 1 ephone Number : 4 0 1 - 3 S(. 

!EE C ‘ 

FBI Number: I miR I 

State Identification Number: | (b)(6), (b)(7)(C) | 


DOB: 
SSN: I 


(b)(6), (b)(7)(C) 


Address : [ 

PO Box: I (b)(6), (b)(7)(C)" 


03H6Hb)(7)(C) I . Providence, 

Barrington. RI 02806 

Telephone Number: 4 01-27 1 /A l and 401-24 

NCIC: Positive 

FBI Number 


RI 02906 

I (b)(6), (b)(7) I 

i ~[pr i 


DOB: 

SSN: 


omMMP) 


Address: I (b)(8), (b)(7)(c) 

Te 1 ephone Number : 401-65 1 
NCIC: No identifiable record 


kt 1 

iffl- I 


erland, RI 02864 


DOB: 

SSN; 


OFFICIAL USE ONLY 

THIS DOCUMENT IS LOANED TO YOU FOR OFFICIAL USE ONLY AND REMAINS THE PROPERTY 
OF THE DEPARTMENT OF HOMELAND SECURITY, ICE. ANY FURTHER REQUEST FOR 
DISCLOSURE OF THIS DOCUMENT OR INFORMATION CONTAINED HEREIN SHOULD BE REFERRED 
TO ICE HEADQUARTERS TOGETHER WITH A COPY OF THE DOCUMENT. 


Page 688 of 929 




OFFICIAL USE ONLY 


DEPARTMENT 

OF 

HOMELAND SECURITY 
ICE 

PAGE 5 

REPORT OF 

I 

NVESTIGATION 

CASE NUMBER | (b)(7)(E) | 

C O N T 

I 

N U A T I O N 

REPORT NUMBER: 001 


Address : ( 

Telephone Number: 508- 67p 
NCIC: Posit ive 


State Identification Number: Q 

| (b)(6), (b)(7)(C) | 


], MA 02721 


DOB 

SSN . 

Address: I (b>(6> (b>(7)(C) I. Saint. L ouis. MO 63109 

Previous Address : I (b)(6), (b)(7)(C) | , Providence, RI 02904 

NCIC: Negative 


DOB: 

SSN: , 

ftddrPBfl. r (b)(6), (b)(7)(C) 


Telephone Number: 401-25[ 
NCIC: Negative 


1 . Brist ol. RI 02809 

-I •>: ''I 


DOB: 

SSN: , 

Address: L (b>(6>.(b>(7>(c> 


Telephone Number: 401 -46L ' 1 " 1 ’' " 1 ‘ 

NCIC: Pos i t ive 

FBI Number: 1 


£rai 

I 


nston, RI 02910 


State Identification Number: 1 ■ (b l< s . ) 

| (b)(G> (b)(7)(C) 



, (b>(6), (b)(7)(C) L W arwick. RI 02888 

Tel ephone Number: 401- 46 | 16>lb /™ >(/) | 

NCIC: Negative 


DOB: 

SSN: , 

Address : L 


NCIC: Positive 

FBI Number: I I 


Narragansett , RI 02888 
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Telephone Number: 401-7 
NCIC: Negative 


The investigation continues. 


], Wakefield, RI 02879 
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1 
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RELATED CASE NUMBERS: 

COLLATERAL REQ: 


TYPE OF REPORT: 
OTHER INFORMATION 


TOPIC: CLOSING OF INVESTIGATION 


SYNOPSIS : 

SYNPOSIS: 

RAC / Providence is initiating an investigation in concert with Operation 
Flicker. This investigation has revealed that there are potentially sixteen 
violators in the Rhode Island area. RAC Providence will work in concert with 
other law enforcement in Rhode Island to determine if these persons are 
involved in the transmission of child pornography. 


This Report 


of Investigation documents the closing 


of this investigation. 


DISTRIBUTION: 
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CONTINUATION 

REPORT NUMBER; 038 


DETAILS OF INVESTIGATION: 

If new information develops on any targets associated with the original 
Operation Flicker investigation, a new case will be generated. RAC Providence 
considers this investigation closed. 
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CASE 

NUMBER 

| (b)(7)(E) 

nr 
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DATE ASSIGNED 

PROGRAM CODE 

REPORT NO. 
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ra 
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RELATED CASE NUMBERS: 


COLLATERAL REQ : 


TYPE OF REPORT: 
OTHER INFORMATION 


TOPIC: CASE CLOSING 


SYNOPSIS : 

In May 2007, The Immigration and Customs Enforcement (ICE) Resident Agent in 
Charge (RAC) office in Savannah, Georgia received information frgm 
RAC/Birmingham, Alabama and the ICE Cyber Crimes Center (C3) about a national 
ICE investigation named Project Flicker relating to identified subscribers 
that used PayPal to pay for and subscribe to internet websites containing 
child pornography content. RAC/Savannah received information on approximately 
17 targets within the Southern District of Georgia. 


All evidence and statistics have been properly been disposed and entered. This 
case is considered CLOSED 


CASE CLOSED. 
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RELATED CASE NUMBERS: 
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OTHER INFORMATION 

TOPIC: CLOSING OF INVESTIGATION 
______ 

The HSI office of the Resident Agent in Charge Providence, Rhode Island 
received a collateral request from the HSI office of the Resident Agent in 
Charge Birmingham, Alabama (RAC/BI) in reference to Operation Flicker. 
According to PayPal records obtained, an individual located in the Providence, 
Rhode Island area of responsibility is involved in the transmittal of monetary 
instruments from the sale of commercial child pornography website memberships. 


This Report of Investigation documents the closing of this investigation. 
Details follow: 
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DETAILS OF INVESTIGATION: 

HSI Providence, Rhode Island received a collateral request from the HSI 
Birmingham, Alabama (RAC/BI) in reference to Operation Flicker. According to 
PayPal records obtained, an individual located in the Providence, Rhode Island 
area of responsibility is involved in the transmittal of monetary i nstrument s 
from th e sa le nf comme rcial child pornography website memberships. | (b>(B>,(b>(7>(c>~| 

I | (DOB | (b)(6), (b)(7)(C) | ) has been identified by PayPal as being a processor for 

the member restricted child pornography websites. 

SA | (b)(6) (b>(7)(c7| queried the original Case Number (WKE) , which is now 

closed . * — — ' 

If there is another request to attempt to locate and interview I (b)(B , > r |f >(/> | , this 
case will be reopened. Since the original Case is closed. HSI RAC Providence 
is closing this investigation. " 

The investigation is closed. 
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In April 2006, the Immigration and Customs Enforcement (ICE), Cyber Crimes 
Center (C3) , Child Exploitation Section (CES) , initiated an investigation into 
a c rimi n al qraaniza tion operating a commercial child pornography website known 
as tiB . " The investigation has revealed that the same 
organization is operating numerous commercial child pornography websites. In 
addition, the organization utilizes various Papal accounts to process the 
payments for access to the member- restricted websites. 

ICE SAC/LA initiated an investigation based on information received from C3 
regarding individuals who have been identified as purchasing subscriptions to 
known child pornography websites. This case will serve as the primary case 
for the Los Angeles Project Flicker targets; however, each individual case 
agent will be required to open their own individual investigative case number. 
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Details of Investigation: 


In April 2006, the Immigration and Customs Enforcement (ICE), Cyber Crimes 
Center (C3) , Child Exploitation Section (CES) , initiated an investigation into 
a c riminal organizat ion operating a commercial child pornography website known 
as " | victims and'. child Imesipl ng'w s ! • 11 The investigation has revealed that the same 
organization is operating numerous commercial child pornography websites. In 
addition, the organization utilizes various Papal accounts to process the 
payments for access to the member- restricted websites. 

SAC/LA Child Exploitation Unit (CEU) received approximately 2000 leads within 
the California area of responsibility (AOR) from the C3 . SAC/LA CEU has been 
designated as the point of contact and distributor of leads to respective 
SAC/LA AOR's. Each office within the SAC/LA area has received the target list 
for their area . 

SAC/LA has approximately 217 individuals identified as having made purchases 
from known child pornography websites. Approximately 26 of those individuals 
were/are subjects of previous or ongoing child pornography investigations such 
as Operation Falcon, Operation Watchdog, Operation Underscore, or Operation 
Emissary I & II. 

SAC/LA will prioritize the target list based on employment, criminal history, 
people in public trust positions etc., and will coordinate with the AUSA’s 
office to obtain oearch/arrest warrants or distribute leads to local and state 
agencies . 

The SAC/LA investigation continues. 
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In April 2006, the Immigration and Customs Enforcement (ICE) , Cyber Crimes 
Center (C3) , Child Exploitation Section (CES) , initiated an investigation into 
a ^ . graanizat i on operating a commercial child pornography website known 

as ' I victims nnd'rhild nnh^T - " The investigation has revealed that the same 
organization is operating numerous commercial child pornography websites. In 
addition, the organization utilizes various PayPal accounts to process the 
payments for access to the member -restricted websites. 

ICE SAC/LA initiated an investigation based on information received from C3 
regarding individuals who have been identified as purchasing subscriptions to 
known child pornography websites. This report is a continuation of ROI 20 
documenting Flicker subjects who will be investigated if/when additional 
investigative information becomes available. 
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Details of Investigation: 


In April 2006, the Immigration and Customs Enforcement (ICE) , Cyber Crimes 
Center (C3) , Child Exploitation Section (CES) , initiated an investigation into 
a c riminal organizat ion operating a commercial child pornography website known 
as " Iviaimi and ch,'id ‘...V nnhil " The investigation has revealed that the same 
organization is operating numerous commercial child pornography websites. In 
addition, the organization utilizes various PayPal accounts to process the 
payments for access to the member-restricted websites. 

The following individuals have been identified as requiring further 
investigative information in order to initiate an investigation regarding the 
purchase of child pornography. If additional evidence becomes available, an 
investigation will be initiated. (See ROI 20) 
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The investigation continues. 
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TOPIC: STATUS UPDATE OF CASE 


SYNOPSIS: 

In April 2006, the Immigration and Customs enforcement (ICE), Cyber Crimes 
Center (C3) , Child Exploitation Section (CES) , initiated an investigation into 
a r r i mi na 1 organ yza t ion operating a commercial child pornography website known 
as ' jySmi' and child " The investigation has revealed that the same 
organization is operating numerous commercial child pornography websites. In 
addition, the organization utilizes various PayPal accounts to process the 
payments for access to the member- restricted websites. 


This Report of Investigation (ROI) notes that the case wa s transferred to 
Homeland Security Investigations (HSI) Special Agent (SA) | (b>(6> (b)(7)(C) | on 
November 1, 2010. 
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DETAILS OF INVESTIGATION: 

In April 2006, the Immigration and Customs enforcement (ICE), Cyber Crimes 
Center (C3) , Child Exploitation Section (CES) , initiated an investigation into 
a cr iminal organizat ion operating a commercial child pornography website known 
as l " The investigation has revealed that the same 

organization is operating numerous commercial child pornography websites. In 
addition, the organization utilizes various PayPal accounts to process the 
payments for access to the member- restricted websites. 

On November 1, 2010, this case was transferred to HSI SA | (b)(6), (b)(7)(c) ~| . 

This case remains in pending status until all collateral cases are closed, all 
evidence has a disposition, and all statistics are updated. 
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TYPE OF REPORT: 
OTHER INFORMATION 



TOPIC: REFERRALS TO STATEL AND LOCAL LEA'S 

* 


ICE RAC/ Cincinnati has received numerous investigative leads from ICE/C3 that 
were generated during an ICE led investigation named Project FLICKER. This 
investigation identified a criminal organization that was oper ating numer ous 
child pornography websites, including one known as 

l35Q9fd)Chiidviaim fl ' I" ■ 

This report of investigation documents the review of the remaining unresolved 
leads and their distribution to the appropriate State/Local agency. 
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DETAILS OF INVESTIGATION: 


ICE RAC/ Cincinnati has received numerous investigative leads from ICE/C3 that 
were generated during an ICE led investigation named Project FLICKER. This 
investigation identified a criminal organization that was oper ating nu merous 
conjm^rcial child pornography websites, including one known as " I u .sctan I 

I 350S(d) Child victims I " • 

Throughout April and July 2008, SSA I ;b)(B , > c ( ) b>(/> | reviewed the unresolved child 
pornography leads received from ICE/C3 and distributed them to State and Local 
law enforcement agencies (STL) throughout southwestern Ohio. This information 
was forwarded to the appropriate STL for field intelligence purposes due to 
the age of the information. 

The following is a list of the identified unresolved leads and the STL that 
they were referred. The list is divided by the month that the referral was 
made : 


Referred to Detective I wig) ( aimici | , Fairfield Township PD (513-78 | >b>lb , > r: |b>|7> | ) . 

Information was provided via telephone . 

I (b)(6) (b)(7)(C) | ; 

Referred to Detective I < b »°>W(7)(C) I . Franklin PD (937-74 1 (b)(6) (b)(7)(c> 1 ) . 

Information was provided via telephone. 

| (b)(6), (b)(7)(C) 1 . 

Referred on, 04/08/2008, t o inves tigator I (b)(6).(b)(7)(c> | , warren County 

Prosecutor's Office (513 -69[_S_j) • Information was provided via telephone. 


I (b)(6), (b)(7)(C) | . 

Referred on, 04/16/2 008 . to npmrHvft l (b>cs> <b>(7>(c> L Butler County Sheriff’s 
Office (513-2C T T' M ) . Information provided via telephone and in person during 
attempted Knock & Talk. 

I (b)(6) (b)(7)(C) | . 

Referred on, 06/09/2008, to Investigator I (b)ts> (b>(7> ( c> | . warren County 

Prosecutor's Office (513-6S | (b>(S ( c) b>!7> | ) • Information was provided via telephone. 

| (b)(6) (b)(7)(C) | . 

Referred on, 06/09/20IU1 j_£q Corporal I ■ (b)(6 > (b > (7 > (C> 1 and I ( b >( 6> ( b >(7xc> | 

Owensville PD (513-73 1 VcV l ) . Information was provided via telephone and 
email . 

| (b)(6) (b)(7)(C) | ; 
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Referred on, 06/10/2008 , to" Captain | (b)(6) (tpnxo | , Troy PD (937-33 1 (b>(6>,(b>(7>(c> |f ~ 

Information was provided via telephone . 


j (b)(6), (b)(7)(C) I ; * 

Referred on, 06/10/2008 , to Sergeant) (b>(6>.(b>(7>(c> |, Sidney PD (93 7-^4s T u '7A u, ' ,; l ) . 

Information provided via telephone. 

| (b)(6), (b)(7)(C) 

Referre d on, 06/11/2008 . to Deputy | (b>(6>,(b>(7xc> | ( Clark County Sheriff’s Office 

(937-52 1 1 ° n 7r™ /> l ) ■ Information provided via telephone with follow-up email. 


I (b)(6), (b)(7)(C) | ; 

Referr ed on. 06 /11/20Q8 . to Officer (b>(6>(b>(7>(c> | , Jackson Township PD 

( 9 3 7 - 6 . Information provided via telephone. 

| (b)(6), (b)(7)(C) | ; 

Ref erre d gn 06/1 2/2008 f to Deputy I (b)(6), (b)(7)(C) [ Meigs County Sheriff's Office 

( 7 4 0 - 9 h TnfnrmaM nn via bplpnhnnp Per follow- up conversation 

with Deputy I (b>(B),(b>(7>(c> | f at her j (b>( 6 > (b) ( 7> ( c> | ) may be the act ual target as 

he has been under investigation in another state for molestation. 

| (b)(6), (b)(7)(C) | . 

Referred on, 06/12/2008, to Officer f msiwmm | . Eaton PD (937-45 |iw B nw™| ) . 
Information provided via telephone with follow-up email. 


Referred on, 0. 
Office (5 13-731 
Detective I (b)(6), (b>(7)(c> 


Z2008, to Investigator I (t»(6> wnxo | . Clermont County Sheriff's 


herif f ' 

513-27^! 

Information provided via telephone, email and in-person meeting. 


) . Information then passed hv the Sheri ff 1 s Offi c 
1 Union Township PD (513-7 d' a|1 ff 1 ' l l. 


| (b)(6) (b)(7)(C) j ; 

Referred on, 0 6/12/20 08 . to Investigator I (b)(6) (b>(7>(c>| / Clermont County Sheriff's 
Office (513-73 r ° ,( 7n° (/) D . Information then passed by the Sheriff's Office to 
Miami Township PD. No contact has been made by Miami Township PD. 

I (b)(6) (b)(7)(C) I ; 

Referred on, 0 6/12/2 008, to Lieutenant I (b)(6), (b)(7)(C) | . Shelby County Sheriff's 

Office (93 7 ' -4 9 l D)lb rnf t/j I ) • Information was then passed to Detective | (b>(6>,(b>(7>(c> I 

( 937 - 4 9 l ,77' ' h a o cho had previously worked a molestation i n ve s t i ga t i on (early 
2008) where I (b>( | fflL ( | 7 Ujy ^ s the alleged subject. During Detective | (bxs) (b)(/)(c> | 
investigatiorn__iS_J claims to have thro wn-awav th e household computer and 
other items in the dumpsters located at, L.. |b>(G> (b>(7>(C lJ place of employment, Berwick 
Steel, Piqua, OH, All items were r ecovered from the dumpster . except for the 
computer. SSA I (b>(B /nf >(/> 1 and Detective | (b)(6),(bx7xc71 interviewed 1(b)(6) (b)(7xc>| on 07/07/2008 at 
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(b)(6), (b)(7)(C) I 


(b)(6), (b)(7)(C) 


OH. 





subscribing to, viewing and download regu! 
to any activities with child pornography 

with his credit c ards in 2006 and again in 2007 and had to cancel both 
accounts . l<b)(S) (b)(7)(C)| also admitted to previously using a PayPal account to make 
purchases through the Internet, but claimed to not know if thg Recount was 
still active. At approximately 22 minutes into the interview I m | stated 
that he wanted to talk with an attorney. 


jnography, but never admitted 
did admit to having issues 


Tom LAWSON: 

Referred on, 06/19/2008, to Detective ! MM.wmm | . Hamilton PD (513-86 [™BF 7T 1 ) . 
Information provided via telephone with follow-up email. 


Referred on, 07/01/2008, to Detective I ( b >(6). (b)(7)(C) [ Dayton PD (937-33l 1U)1 7-7”' , l) . 

Information provided via telephone with follow-up email. 

(b)(6) (b)i7)(C) | (aka I Ib)(6) >b)i7)(C) | ) / | (b)(BHb)(7) | 

(b)(6) (b)(7)(C) I ; 

Referred on. 0 7/02 /200 8. to Detective I (b)(6) (b)(7)(C) | . Hamilton County Sheriff's 

Office ( 513 - 94 l_j2_j) • Information provided duri ng in-p erson meeting. Hardcopy 
informational packets were provided to Detective I |D> '7ci D)1/) I - 

Copt- act information for SSA I (D,! 7 r . ( f’ T7r | was provided to affected agencies. SSA 
| (b)(B , ) c < b)(/) | also stated that ICE could provide assistance if requested. 

RAC/Cincinnati case is closed. 


OFFICIAL USE ONLY 

THIS DOCUMENT IS LOANED TO YOU FOR OFFICIAL USE ONLY AND REMAINS THE PROPERTY 
OF THE DEPARTMENT OF HOMELAND SECURITY, ICE. ANY FURTHER REQUEST FOR 
DISCLOSURE OF THIS DOCUMENT OR INFORMATION CONTAINED HEREIN SHOULD BE REFERRED 
TO ICE HEADQUARTERS TOGETHER WITH A COPY OF THE DOCUMENT. 


Page 713 of 929 




REQUESTED BY : | (b>(s> c> 1 

OFFICIAL USE ONLY 



The office of the Resident Agent in Charge/St Louis received requests for 
assistance from the Cyber Crimes Center (C3) and from the Resident Agent in 
Charge/Birmingham, AL, concerning an upcoming nationwide investigation 
targeting commercial child pornography websites and their subscribers. The 
investigation has been dubbed Project Flicker and targets eighteen 
member- restricted child pornography websites as well as fourteen individuals 
responsible for the collection and dissemination of subscriber fees. 


One such ind ividua l j s I (b>(6)(b>(7>(c> | Q f Caseyville, IL. A knock -and -talk 

interview of I'nvnl and seizure of a personal computer took place on 3/01/07. 
Since that time, this office has received information on approximately sixty 
subscribers to pay child pornography websites. Additional details follow. 
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CONTINUATION 


DETAILS OF INVESTIGATION: 

As reported previously under this case number, on 3/01/07, Federal Bureau of 
Investigation (FBI) agents and local police officers assigned to the FBI's 
Metro East Cyber Crimes and A nalysis Task Forc e (suburban St. Louis) conducted 
a knnrk- and -talk interview of I (b)(6), (b)(7)(c) | at her residence, I WW-wwo | 

| (b)(6), (b)(7)(C) [. IL 62232. A website listed in a tip to the National Center 

for Missing and Exploited Children (ncmec) led FBI agents to | ag j. In that 
interview, agents were able to solicit I 1 cooperation and received written 

consent to search her notebook computer) wnicn she said was used exclusively 
to conduct her "business" with processing payments through Pay Pal for the 
wp.hsit-.es unde r investigation. At the request of Senior Special Agent (SSA) 

| (b)(6), (b)(7)(C) | of C3 , this office coordinated efforts with the FBI's Metro East 

Cyber Crimes and Analysis Task Force. 



(b)(6), (b)(7)(C>, (b)(7)(E) 


The investigation is continuing. 
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REPORT OF INVESTIGATION , 


CONTINUATION 

REPORT NUMBER: 003 


UNDEVELOPED LEADS : NONE 
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REPORT OF INVESTIGATION 


TITLE: COMMERICAL CP WEBSITE KNOWN AS 


CASE STATUS: 


REPORT DATE 
021308 


DATE ASSIGNED 
040407 


REPORT NO. 
004 


RELATED CASE NUMBERS 


COLLATERAL REQ : 


TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 


SYNOPSIS: 

The office of the Resident Agent in Charge/St Louis received requests for 
assistance from the Cyber Crimes Center (C3) and from the Resident Agent in 
Charge/Birmingham, AL, concerning an upcoming nationwide investigation 
targeting commercial child pornography websites and their subscribers. The 
investigation has been dubbed Project Flicker and targets eighteen 
member- restricted child pornography websites as well as fourteen individuals 
responsible for the collection and dissemination of subscriber fees. 

One such ind ividua l is I (bK6),(bX7)(C) | 0 f Caseyville, IL. A knock-and- talk 

interview of l |b m/A 0) l and seizure of a personal computer took place on 3/01/07. 
Since that time, this office has received information on approximately sixty 
subscribers to pay child pornography websites who reside in the St Louis area 
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REPORT OF INVESTIGATION 

CASE NUMBER | (b)(7)(E) | 

CONTINUATION 

REPORT NUMBER: 004 


As reported previously under this case number, | (b)(6), (b)(7)(c> | was identified as 

one of several PayPal payment processing subjects associated with the 
investigative activity conducted under Project Flicker. The office of the 
Resident Agent in Charge/St Louis (RAC/St Louis) continues to pursue 
investigative leads on numerous subscribers to paid child pornographic 
websites identified through Project Flicker. From the onset of this 
investigation, it was understood that and the other PayPal payment 

processor subjects throughout the U.S. would be prosecuted for several 
possible violations in Birmingham, AL, among them, acting as an unregistered 
money remitter. 

SSA | (b)(6), (b)(7)(C) | of the ICE Cyber Cri mps ^l-. pr (C3) has advised that the 

details of any criminal charges against I m/n 1 and the other PayPal subject are 
still being worked out with the U.S. Attorney' s offic e in Birmingham, AL. The 
RAC/St Louis office is still in possession of | (bK ^ ( ) b > (/ > | notebook computer which 
she used for her PayPal "business'', a forensic image made of the hard drive of 
that notebook PC, and bank records which had been subpoenaed from the 
RAC/Birmingham office. It was requested that the RAC/St Louis office maintain 
these items until an agreement could be worked out with the U.S. Attorney's 
Office in Birmingham. This office is currently working on numerous subscriber 
leads which have been received through Project Flicker in the RAC/St Louis 
Area of Responsibility. For each of those subjects with prosecution 
potential, a separate case number will be opened. This case is being kept 
open for general investigative activity related to Project Flicker, as well as 
for the p urpose of resp onding to any additional requests for assistance 
regarding | o^g) ( b)(7)(C) | from C3 or the RAC/Birmingham. 

The investigation is continuing. 

UNDEVELOPED LEADS : NONE 
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TOPIC: UPDATE • 

■ CASE PLACED INTO PENDING STATUS 


The office of the Resident Agent in Charge/St Louis received requests for 
assistance from the Cyber Crimes Center (C3) and from the Resident Agent in 
Charge /Birmingham, AL, concerning an upcoming nationwide investigation 
targeting commercial child pornography websites and their subscribers. The 
investigation has been dubbed Project Flicker and targets eighteen 
member -restricted child pornography websites as well as fourteen individuals 
responsible for the collection and dissemination of subscriber fees. 


One such individual is I ( b >( 6 > (b)(?xc) H of Caseyville, IL. | (b m/g b> l has cooperated 
with investigators and was placed in contact with agents from the 
RAC/Birmingham. Project Flicker leads will continue to be worked as 
individual investigations. 


ku u -i 


) (b)(7)(E) 

! [ SENIOR SPEC AGENT 


apppovRn? 

1 RAC-RESIDENT AGENT IN 
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CONTINUATION 

REPORT NUMBER: 005 

DETAILS OF INVESTIGATION: 

As reported previously under this case number, [_ 

(b)(6). (b>(7>(c> 1 W as identified as 


one of several PayPal payment processing subjects associated with the 
investigative activity conducted under Project Flicker, The office of the 
Resident Agent in Charge/St Louis (RAC/St Louis) continues to pursue 
investigative leads on numerous subscribers to paid child pornographic 
websites identified through Project F licker . From the onset of this 
investigation, it was understood that [‘gf/cfl and the other PayPal payment 
processor subjects throughout the U.S. would be prosecuted for several 
possible violations in Birmingham, AL, among them, acting as an unregistered 
money remitter. 

SSA | (b>(6>, (b>(7>(c> | of the ICE Cyber Crime.^j^fiflfer (C3) has advised that the 
details ot any criminal charges against I mto I and the other PayPal subject are 
still being worked out with the U.S. .Attorney's Office in Birmingham, AL. 

This office has previously retrieved | ,b>(6 ( c ( ) b>(7> | notebook computer from the FBI, 
Fairview Heights, IL, field office, ana on Vl8/08, transferred it to the 
RAC /B irmingham . Criminal charges are still pending in Birmingham, AL, against 
and the fourteen other PayPal payment processors identified through this 
investigation. 

This office is currently working on numerous subscriber leads which have been 
received through Project Flicker in the RAC/St Louis Area of Responsibility. 
For each of those subjects with prosecution potential, a separate case number 
will be opened. This case is no longer being kept open for general 
investigative activity related to Project Flicker, and will be placed into 
Pending status at this time, until the notebook computer seized in this 
investigation is disposed of. 

UNDEVELOPED LEADS : NONE 
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The office of the Resident Agent in Charge, St Louis, MO, received requests 
for assistance from the Cyber Crimes Center (C3) and from the Resident Agent 
in Charge, Birmingham, AL, concerning an upcoming nationwide investigation 
targeting commercial child pornography websites and their subscribers. The 
investigation has been dubbed Project Flicker and targets eighteen 
member- restricted child pornography websites as well as fourteen individuals 
responsible for the collection and dissemination of subscriber fees. 

One such individual is I jb>(G> (b>(7>(c> | Q f caseyville, IL. Pm/cH has cooperated 

with investigators and was placed in contact with agents from the 
jRAC/airmingham . This case remains in Pending status due to the fact that 
I in I laptop computer is still being held as evidence. Additional details 
follow. 


DISTRIBUTION ; 
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CONTI 

N U A T I 0 N 

| REPORT NUMBER : 

006 


DETAILS OF INVESTIGATION: 


As reported previously under this case number, I (bxs) (b>(7xo | W as identified as 

one of several PayPal payment processing subjects associated with,. the 
investigative activity conducted under Project Flicker. The office of the 
Resident Agent in Charge, St Louis, MO, {RAC/St Louis) continues to pursue 
investigative leads on numerous subscribers to paid child pornographic 
websites identified through Project Flicker. From the onset of this 
investigation, it was understood that HIGH and the other PayPal payment 
processor subjects throughout the U.S. would be prosecuted for several 
possible violations in Birmingham, AL, among them, acting as an unregistered 
money remitter. 


^ of the ICE Cyber Crime, 


details o£ any criminal charges against 
still being worked out with the ci- s - , Attorn. 


( C3 ) has advised that the 
and the other PayPal subject are 

hj , — y j 1 s Office in Birmingham, AL. 

This office has previously retrieved |(t»rs> (b>[7xc)| notebook computer from the FBI, 
Fairview Heights, IL, field office, and on 3/18/08, transferred it to the 
RAC /p i rm i ngham . Criminal charges are still pending in Birmingham, AL, against 
l tP m/n a) l and the fourteen other PayPal payment processors identified through this 
investigation . 


This office is currently working on numerous subscriber leads which have been 
received through Project Flicker in the RAC/St Louis Area of Responsibility. 
For each of those s ubjects with prose cution potential, a separate case number 
will be opened, da I (b>(B> (b>(7>(c> | Q f RAC/ Birmingham recently advised that 

| |byi ^ ,1/) | notebook computer still needs to be maintained as evidence;- and the 
investigation into the PayPal targets is now being led by C3 . This case will 
remain in Pending status until the notebook computer seized in this 
investigation is disposed of. 


UNDEVELOPED LEADS : NONE 


OFFICIAL USE ONLY 

THIS DOCUMENT IS LOANED TO YOU FOR OFFICIAL USE ONLY AND REMAINS THE PROPERTY 
OF THE DEPARTMENT OF HOMELAND SECURITY, ICE. ANY FURTHER REQUEST FOR 
DISCLOSURE OF THIS DOCUMENT OR INFORMATION CONTAINED HEREIN SHOULD BE REFERRED 
TO ICE HEADQUARTERS TOGETHER WITH A COPY OF THE DOCUMENT. 


Page 726 of 929 




REQUESTED BY: 


OFFICIAL USE ONLY 


DEPARTMENT OF HOMELAND SECURITY 
ICE 


REPORT OF INVESTIGATION 


TECS ACCESS CODE 
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CASE number! 


TITLE: COMMERICAL CP WEBSITE KNOWN AS “Z 1 






CASE STATUS: 

INTERIM RPT 



REPORT DATE 
053109 

DATE ASSIGNED 
040407 

PROGRAM CODE 

ra 

REPORT NO. 
007 

RELATED CASE NUMBERS: | (b>(7>(E> 

ZT 


COLLATERAL REQ 





INVESTIGATIVE FINDINGS 


TOPIC: CASE UPDATE - PENDING INVESTIGATION 


SYNOPSIS : 

The office of the Resident Agent in Charge/St Louis received requests for 
assistance from the Cyber Crimes Center (C3) and from the Resident Agent in 
Charge/Birmingham, AL, concerning an upcoming nationwide investigation 
targeting commercial child pornography websites and their subscribers. The 
investigation has been dubbed Project Flicker and targets eighteen 
member-restricted child pornography websites as well as fourteen individuals 
responsible for the collection and dissemination of subscriber fees. 


One such individual is Q 


| of Caseyville, IL. 


_ has cooperated 

with investigators and was placed in contact with agents £rom the 
RAC/Birmingham. This report seeks to update the status of the investigation. 
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CASE NUMBER | 

CONTINUATION 

REPORT NUMBER: 007 

DETAILS OF INVESTIGATION: 


A s reported previously under this case number, I (b>(6> (b>(7xc> | was identified as 

one of several PayPal payment processing subjects associated with,, the 
investigative activity conducted under Project Flicker. The office of the 
Resident Agent in Charge/St Louis (RAC/St Louis) continues to pursue 
investigative leads on numerous subscribers to paid child pornographic 
websites identified through Project Flicker. From the onset of this 
investigation, it was understood that I mtO I and the other PayPal payment 
processor subjects throughout the U.S. would be prosecuted for several 
possible violations in Birmingham, AL, among them, acting as an unregistered 
money remitter. 

SSA | (b)(6), (b)(7)(C) | of the ICE Cyber Crime s Cent er (C3) has advised that the 

details of any criminal charges against | (b mic ( ) b> l and the other PayPal subject are 
still being worked out with the U.S. Attorne y 1 s Office in Birmingham, AL. 

This office has previously retrieved I I notebook computer from the FBI, 

Fairview Heights, IL, field office, and on 3/18/08, transf erred—it^to the 
RAC/Birmingham. Criminal charges are still pending in against I (Vo I and the 
fourteen other PayPal payment processors identified through this 
investigation. 

This case is no longer being kept open for general investigative activity 
related to Project Flicker, and has been placed into Pending status until the 
notebook computer seized in this investigation is disposed of. 

UNDEVELOPED LEADS : NONE 
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This investigation was opened based upon information received from the ICE 


Cyber Crimes Center (C3) and from the Resident Agent in Charge/Birmingham, AL, 
concerning commercial child pornography websites and their subscribers, later 
known as Project Flicker. Project Flicker targeted eighteen member- restricted 
child pornography websites as well as fourteen individuals responsible for the 
collection and dissemination of subscriber fees. 

One such individual is I (b>(6> (b>(7>(o | 0 f Caseyville, IL. I ( qfrcfl has cooperated 

with investigators and was placed in contact with agents from the 
RAC/Birmingh am Evidence seized in the investigation has recently been 
returned to P/ywc^l , and this investigation is being closed at this time. 
Additional details follow. 
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CASE NUMBER | (b>(7>(E> j 

REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: 008 


DETAILS OF INVESTIGATION: 


As reported previously under this case number, I w(s> (b)(7)(C) | wa s identified as 

one of several PayPal payment processing subjects associated with the 
investigative activity conducted under Project Flicker. The office of the 
Resident Agent in Charge/St Louis {RAC/St Louis) pursued investigative leads 
separately on numerous subscribers to paid child pornographic websites 
identified through Project Flicker. 

SSA I P»m (b)(7)(C) | of the ICE Cyber Crimes Center (C3) and St I WMB ~~l 

of RAC/ Birmingham have advised that criminal charges against and the 

other PayPal subjectajmvebeen declined. Both also advised that the evidence 
seized in this case, I |D>( 7r-. b>1/> I notebook comput£ri_i^iich she used to process the 
PayPal payments, can be returned to her. | ( b> <6H b >(7) | note book pc was not found to 
contain any contraband files. 

j wibMPH') | Toshiba nr.l-pVjor-.Vr PP wag r-pt-|ir-n<=>ri by fift | |,,^, ) * 6> ^ t ’ >(7>(C) I to SA ESSD/ and Was 
then turned over to 1 (b>(6>(b>(7>(c> | on 8/06/09. I >b mrn tb) l signe d both Fo ma 60 5 IS and 

CBP Form 7605 (Disposition Order) in the presence of SAs | (b>( 7c (b>(/> l and I (b>(6>,(b>(7>(c> | 

to document the return of the property. As no further action on this matter 
is anticipated, this case is being closed at this time. 

UNDEVELOPED LEADS : NONE 
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| CASE NUMBER 1 

(b)(7)(E) 

r 





CASE STATUS: 


OPEN & CLOSE 


REPORT DATE 
061407 


DATE ASSIGNED 
060607 


RELATED CASE NUMBERS: 


COLLATERAL REQ : 


TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 


REPORT NO. 
001 


TOPIC: OPENING OF GENERAL CASE TO TRACK ICE RAC/PB LEADS 


SYNOPSIS: 

SAC/Birmingham, AL, Project Flicker identified several subjects targets in the 
RAC/PB AOR who had subscribed and u til ned an i 11 eaa 1 child pornography 
Internet site identified as The 1.,'^ • This site offered images 

and movies of hardcore child exploitation. 

All in vpfit-iaaM vp leads will be reviewed under ICE RAC/PB case number 
| (b)(7)(E) ] to determine investigative merit and appropriate adjudication. 


1 PHHik fed i) * i \ it *•]_< 


(b)(7)(E) , 

! (b>(6), (b)(7)(C) 1 SENIOR SPEC AGENT 



. APPROVED ; 

| (b>(6>, (b)(7)(C) | oi GRP SUPERVISOR 

ORIGIN OFFICE: PB 
PITTSBURGH, PA - RAC 

TELEPHONE: 412 4 3 '"'"fiS"'" 1 

TYPIST: 1 (b>( 6 > (b)(7)(C) 1 
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CASE NUMBER ! 


0 “ 


TITLE: COMMERICAL CP WEBSITE KNOWN AS 

CASE STATUS: 

CLOSING RPT 



REPORT DATE 

DATE ASSIGNED 

PROcmm CODE 

REPORT NO. 

053107 

051407 

LEI 

001 

RELATED CASE NUMBERS: 

COLLATERAL REQ: 

TYPE OF REPORT 




OTHER INFORMATION 



TOPIC: CASE OPENED 

IN ERROR 




Case was opened in error. The target is located in RAC Raleigh area of 
responsibility and will be reassigned as appropriate. 

Case closed. 


; , --MHihfetiU.-k a :\*w * 


(b)(7)(E) 

| (b)(6), (b)(7)(C) 

| SENIOR SPEC AGENT 


APPROVED- 


! (b)(6), (b)(7)(C) 

1 RAC-RESIDENT AGENT IN 




ORIGIN OFFICE: WS 
WINSTON/SALEM, NC - 

TELEPHONE: 336 63| 1 


TYPIST : 1 m ™' , > | 
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REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: 001 


Case was opened in error. The target is located in RAC Raleigh area of 
responsibility and will be reassigned as appropriate. 


Case closed. 
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CASE 

NUMBER 1 mm 1 


TITLE: COMMERICAL CP WEBSITE KNOWN AS ^’ui Ind'c^'ia -Lnes!^ ','£T 


CASE STATUS: INTERIM RPT 


REPORT DATE 

DATE ASSIGNED 

PROGRAM CODE 

REPORT NO. 

061907 

061807 

LU 

002 


RELATED CASE NUMBERS: 


COLLATERAL REQ : 


TYPE OF REPORT: 
OTHER INFORMATION 


TOPIC: REOPENING OF CASE 


SYNOPSIS: » 

It is requested that I (b>(7xe> | be reopened to report the progress of the 

Project Flicker I investigation in the RAC Raleigh, RA Winston-Salem area 

of responsibility. 

RAC Birmingham originally sent three collateral requests under the same case 
number to RAC Raleigh for Project Flicker targets, two of which we re in RAC 
Raleigh AOR and the third in RA Winston-Salem AOR. I ( b >(s> wxc) 1 was 

mistakenly used to open a collateral case on one of tty? RAC Raleinh targets 

and then subsequently closed. The use of case number | (b>(7>(E> | will 

allow RAC Birmingham to track the progress of the Winston-Salem investigation 
in TECS . 

This ROI serves to explain why the case is being reopened. Details contained 
herein. 


« W: « v ; « * :1* t * i*J ) H| .v 



J SENIOR SPEC AGENT 
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CASE NUMBER | (b)(7)(E) | 

REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: 002 


DETAILS OF INVESTIGATION 

Project Flicker da is an ongoing joint investigation between the Office of 
the Resident Agent in Charge, Birmingham, Alabama { RAC/BI) , the ICE Cyber 
Crimes Center (C3/CES) , the Postal Inspection Service, the United States 
Attorney's Office for the Northern District of Alabama, and Department of 
Justice/CEOS that has targeted both the principles facilitating subscription 
payments and actual subscribers of several commercial child exploitation 
member restricted websites. The project has identified at least 18 separate 
child exploitation member restricted websites and approximately 14 principles 
responsible for the collection of the associated monthly subscription fees. 

It is requested that I (b)(7)(E) ~| be reopened to report the progress of the 

investigation in the RAC Raleigh, RA Winston-Salem area of responsibility. 

RAC Birmingham originally sent three collateral requests under the same case 
number to RAC Raleigh for Project Flicker targets, two of which wer e in RAC 
Raleigh AOR and the third in RA Winston-Salem AOR. I (b)(7)(E) | was 

mistakenly used to open a collateral case on one of t he RAC Raleigh t argets 
and then subsequently closed. The use of case numher I < B > (7 >' E > | will 

allow RAC Birmingham to track the progress of the Winston-Salem investigation 
in TECS . 

Investigation continues. 
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PAGE 1 


REPORT OF 

INVESTIGAT 

ION 






CASE NUMBER | (b)(7)(E) | 

TITLE: COMMERICAL CP WEBSITE KNOWN AS|^— 

CASE STATUS: 

CLOSING RPT 




REPORT DATE 

DATE ASSIGNED 

PROG, 

1AM CODE 

REPORT NO. 

120607 

061807 


2 ) 

008 

RELATED CASE NUMBERS: 

COLLATERAL REQ: 

TYPE OF REPORT 





OTHER INFORMATION 




TOPIC: DECLINATION 

OF PROSECUTION AND CASE CLOSURE 

* 


SYNOPSIS: 

Project Flicker (EaJ is an ongoing joint investigation between RAC/BI, 

Crimes Center {C3/CES) , the Postal Inspection Service, the U.S.A.O. for the 
Northern District of Alabama, and DOJ/CEOS that targeted both the principles 
facilitating subscription payments and subscribers of child exploitation 
member-restricted websites. The investigation identified numerous child 
exploitation member restricted websites and 14 principles responsible for the 
collection of the associated monthly subscription fees. RAC Raleigh, RA 
nnpneri a collateral investigation reg arding one of the 
principles, I (Pxs>ib)i7>iC) I , Greensboro, N.C. 

Fol lowing the forensic examination of the seized compute r, and the review of 
arVj-i t- -i nnai and information, AUSA I (b)(6), (b)(7)(C) | declined prosecution 

of 1 (b)(8), (b)(7)(C) | j, n the Middle District of North Carolina. A copy of I ( b >( B >, (b)(7)(C)] 

hard drive will be made available to RAC Birmingham and this collateral 
investigation will be closed. Details contained herein. 




| (b)(7)(E) I 


1 SENIOR SPEC AGENT 1 


■ ■ 

aPPnovF.n- 


(b)(6),(b)(7)(C> 

j RAC -RESIDENT AGENT IN 




ORIGIN OFFICE: WS 
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TYPIST- I 1 VA" '1 
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CASE 

NUMBER 1 

(b)(7)(E) | 

REPORT OF 

I 

NVESTIGATION 





CONTINUATION 


REPORT NUMBER: 008 


DETAILS OF INVES TIGAT ION 

Project Flicker (I 1) is an ongoing joint investigation between RAC/BI, 

Crimes Center (C3/CES) , the Postal Inspection Service, the U.S.A.O. for the 
Northern District of Alabama, and DOJ/CEOS that targeted both the principles 
facilitating subscription payments and subscribers of child exploitation 
member-restricted websites. The investigation identified numerous child 
exploitation member restricted websites and 14 principles responsible for the 
collection of the associated monthly subscription fees. RAC Raleigh, RA 
Winston-Sal em opened a collateral investigation reg arding one of the 
principles, I fb>(G> (b>(7xc: 1. Greensboro, N.C. 

Following the forensic examination of the seized computer, and the review of 
ad ditional eviden ce and information, AUSA Mike DeFranco declined prosecution 
of | WIG) (a)(7)(c> | i n the Middle District of North Carolina. 

A copy of | (b)(6), (b)(7)(C)] hard drive was made and will be made available to RAC 
Birmingham to assist with their investigation. 

No further investigative action is anticipated in the Winston-Salem AOR having 
to do with | (b)(6) ( b>(7)(o | . 

Case closed. 
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CASE NUMBER | (b)(7)(E) | 

REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: 001 


The ASAO/Orl anrip office has initiated a collateral investigation regarding 
| (b)(6). (b)(7)(C) I pursuant to a request from the RAC/Birmingham office. The RAC/ 

Birmingham office is conducting a joint investigation (Project Flicker) with 
the ICE Cyber Crimes Center (C3) the U.S. Postal Inspection Service, and the 
Department of Justice Child Exploitation and Obscenity Section (CEOS) . 

Project Flicker has targeted both the principles facilitating subscription 
payments and actual subscribers of numerous commercial child exploitation 
member restricted websites. The project has identified at least 18 separate 
child exploitation member restricted websites and approximately 14 principles 
responsible for the collection of the associated monthly subscription fees. 


(b)(7)(E) 


One of t he fo urteen Pa yPal acc ount holders has been identified as |(b)(s> (b)(7)(c) | 

| (b)(6), (b)(7)(C) I (DOB: I (b)(6), (b)(7)(C) I) (ss# | (b)(6), (b)(7)(C) l who resid es at I (b)(8), (b)(7)(C) |, 

Sanford FI 32773. Investigative research shows that | (^xs) (b)(7)(C) | is related to the 
following email accounts: 


(b)(6), (b)(7)(C) 


| (b)(6), (b)(7)(c) | i s believed to related to the following bank accounts which have been 
or are being used to facilitate the movement of proceeds obtained from the sale 
of memberships to child exploitation 


Washington Mutual accoun ts I (b)(G|(b)(7|(C> I 
Bank of America account# | (b)(6), (b)(7)(C) | 



Both vehicles are registered to I (b)(6), (b>(7)(c> | a t his residence. 


Investigation continues. 
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REQUESTED BY: 



CASE STATUS: INTERIM RPT 


REPORT DATE DATE ASS IGNED 

012408 051007 

RELATED CASE NUMBERS: 

COLLATERAL ‘REQ: 


TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 


TOPIC: CASE UPDATE 


SYNOPSIS : 

Pursuant to collateral request from the RAC/Birmingham office, the A S AC /Orlan do 
as initiated an investigation of an individual identified as |(b>(s>,(b>(7>(c>1 
Information obtained from the RAC/Birmingham office shows that 
is operating an internet PayPal account that collects monthly 
subscriber fees for access to child pornography websites. 

On July 26, 2007, ASAC/Orlando special aar-nt-g and RAC/Birmingham special agents 
executed the federal search warrant at I W(B), (b)(7)(C) | residence. As a result of the 
search warrant, ASAC/Orlando special agents seized three computers. 

ASAC/Orlando special agents are currently waiting for the forensic examination 
of the above-mentioned computers. 

Investigation continues. 
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REPORT OF INVESTIGATION 

TECS ACCESS CODE 

PAGE 1 

CASE NUMBER | (b)(7)(E) | 

TITLE: COMMERICAL CP WEBSITE KNOWN AS 

CASE STATUS: INTERIM RPT 

REPORT DATE 
043008 

DATE ASSIGNED 
051007 

PROCjJ 

CODE 

(b)(7) 1 

REPORT NO. 
005 

RELATED CASE NUMBERS: 


COLLATERAL REQ: 


TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 


TOPIC: CASE STATUS 


SYNOPSIS: 

Based upon a collateral request from the RAC/Birmingham office, the 
AS AP /Or! anrio offic e has initiated an investigation of an individual identified 
as I (b)(6), (b)(7)(c> | information obtained from the RAC/Birmingham office shows 

that | (b)(6 ), who | j s operating an internet PayPal account that collects monthly 
subscriber fees for access to child pornography websites. This investigation 
is part of a nationwide operation titled "Project Flicker" . 

On July 26, 2007, ASAC/Orlando special agents .and. .RAP./Ri rmingham special 
agents executed the federal search warrant at | cb>c6>,(b>(7>cc> (residence. As a 
result of the search warrant, ASAC/Orlando special agents seized three 
computers. 

ASAC/Orlando special agents are currently waiting for the completion of the 
forensic examination of the above-mentioned computers. 

Investigation continues. 


1 h 1 Hi Pul lin III 1 1 IIIM 

SIGNATURE: , 

I (b)(7)(E) | 

1 (b)(6), (b>(7>(C> I SENIOR SPEC AGENT 
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SYNOPSIS: 

Based upon a collateral request from the RAC/Birmingham office, the 
AS AC/Orlando office has initiated an investigation of an individual identified 
as I (b)(6) (b)(7)(C) | . Information obtained from the RAC/ Birmingham office shows 

that | (b)(6), (b)(7)(C) | i s operating an internet PayPal account that collects monthly 
subscriber fees for access to child pornography websites. This investigation 
is part of a nationwide operation titled "Project Flicker". 

On July 26, 2007, ASAC/Orlando special agents and RAC /Bi rmingham special 
agents executed the federal search warrant at I ( b >( 6 >. (b)(7)(c) | residence . As a 
result of the search warrant, ASAC/Orlando special agents seized three 
computers . 

An update to the investigation is contained in the body of this report. 



ORIGIN OFFICE: OL TELEPHONE: 4 07‘ 8! 

ORLANDO, FL - ASAC . 

I repisrTl^a 
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CONTI 
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006 


tHp ASAr/nrlandn nffiee initiated an investigation of an individual identified 
as | (b)(6). (b)(7)(C) I pursuant to a collateral request from the RAC/Birmingham 


office. RAC/Birmingham speci al agents developed information during there 
investigation that shows that fw(6> -(b)(7)(C) | was operating an internet PayPal account 
that collected monthly subscriber fees for access to child pornography 
websites. This investigation is part of a nationwide ICE investigation titled 
"Project Flicker". 

On July 26, 2007 ASAC/Orlando specia l agents an d RAC/Birmingham special agents 
executed a federal search warrant at | (b)(6) (b>(7xc> | residence. As a result of the 
search warrant, ASAC/Orlando special agents seized three computers. 

An ASAC/Orlando computer forensic special arrant- conducted a computer forensic 
examination of the computers found in I < b >< 6 > t b « 7 >( c > I residence and found that one 
of the computers contained approximately twenty five images of child 
pornography. The images were found in temporary internet files and in 
lost/free space files. 

On January 16, 2009 ASAC/Orlando special agents spoke with AUS A I w< G j.iWi 7 N c > .1 
regarding the results of the investigation-concerning |(b>(B> (b)(7>tc)~| . AUSA | (b>< ® c ( > b>(7> f 
declined to proceed with prosecution of | (b)(8), (b>(7xc>| < 

All evidenc e , that do es not contain images of child pornography will be 
returned to |( b >(S).(b)(7)(c)| . 

. This i nves H gat inn is placed in pending status until the destruction of 
| (b)(6), (b)(7)(C) | computer that contained child pornography is completed. 
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CASE NUMBER I 


TITLE: COMMERICAL CP WEBSITE KNOWN AS | V ,S SS “b T 

CASE STATUS: 


CLOSING RPT 



REPORT DATE 
012609 

DATE ASSIGNED 
051007 

PROfjRftMj CODE 

REPORT NO. 
007 

RELATED CASE 

NUMBERS : 




COLLATERAL REQ: 


TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 


TOPIC: INVESTIGATION CLOSED 


SYNOPSIS: 

Pursuant to a collateral request from the RAC/Birmingham office, the 



« 

b)(7)(C) |. 

(b)(6), (b)(7)(C) | 

operated 
to child 

access ! 
Flicker 


Information from the RAC/Birmingham office shows that 
an internet PayPal account that collected subscriber fee 
orn websites. This investigation is part of "Operation 


flSAP/nrianrin special agents obtained and executed a federal search warrant at 
I (b)(6), (b)(7)(C) I residence. Based upon the search warrant ASAC/Orlando special 
agents seized several c omputers and other items from his residence. 
Prosecution of | (b)(6), (b)(7)(c) | was subsequently declined by the U.S Attorney office. 

All items that were seized have been returned to | (b>(6>.(b>(7>(c> | or destroyed. This 
investigation is closed. 
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TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 


SYNOPSIS: 

Project Flicker is an ongoing joint investigation between the Office of 

the Resident Agent in Charge, Birmingham, Alabama (RAC/BI) , the ICE Cyber 
Crimes Center (C3/CES) , the Postal Inspection Service, the United States 
Attorney's Office for the Northern District of Alabama, and Department of 
Justice/CEOS that has targeted both the principles facilitating subscription 
payments and actual subscribers of several commercial child exploitation 
member restricted websites. The project has identified at least 18 separate 
child exploitation member restricted websites and approximately 14 principles 
responsible for the collection of the associated monthly subscription fees. 

This report details the investigation with regards to RAC Indianapolis to 
date . « 
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DETAILS OF INVESTIGATION: 

Project Flicker (2S2) is an ongoing joint investigation between the Office of 
the Resident Agent in Charge, Birmingham, Alabama {RAC/BI ) , the ICE Cyber 
Crimes Center (C3/CES) , the Postal Inspection Service, the United States 
Attorney's Office for the Northern District of Alabama, and Department of 
Justice/CEOS that has targeted both the principles facilitating subscription 
payments and actual subscribers of several commercial child exploitation 
member restricted websites. The project has identified at least 18 separate 
child exploitation member restricted websites and approximately 14 principles 
responsible for the collection of the associated monthly subscription fees. 


(b)(6), (b)(7)(C), <b)(7><E> 


Investigation on going. 
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SYNOPSIS : 

The ASAC/Norfolk has received information concering an individual in Suffolk, 
Virginia, that is maintaining a Pay Pal Account to process transactions for 
websites providing child pornography for monthly fees. The investigation is 
ongoing i nnuii rip ig in Project Flicker. The individual 

identified as I ( b >(6>. (b)(7)(C) | , The ASAC/Norfolk will investigate p>(s>, (b)(7)(C) | and 

take appropriate action. 
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TOPIC: LONDON MAIL BOXES ETC ADDRESS 
SYNOPSIS: 

ICE RAC Birmingham and the ICE Cyber Crimes Center (C3) are conducting 
Operation Flicker, a joint investigation into numerous subjects in the United 
States, Great Britain, Russia, Belarus, and Latvia involved in distribution of 
child pornography through member-restricted Internet websites. The primary 
focus of the first phase of the investigation is to identify and prosecute the 
manufacturers and distributors of the child pornography. The second phase of 
the investigation will be to identify and prosecute the thousands of 
subscribers who have purchased subscriptions to the websites in order to view 
the images . 

ICE Attache London received a request to investigate members of the network 
possibly using a mailbox at a MAILBOXES, ETC., facility located at 37 Store 
Street, London, England, to communicate with one another. Officers of the 
Metropolitan Police Pedophile Unit (METPED) agreed to assist in this 
investigation. This report documents the results of the METPED. 
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REPORT OF INVESTIGATION 
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DETAILS OF INVESTIGATION 

ICE RAC Birmingham and the ICE Cyber Crimes Center (C3) are conducting 
Operation Flicker, a joint investigation into numerous subjects in the United 
States, Great Britain, Russia, Belarus, and Latvia involved in distribution of 
child pornography through member- restricted Internet websites. The primary 
focus of the first phase of the investigation is to identify and prosecute the 
manufacturers and distributors of the child pornography. The second phase of 
the investigation will be to identify and prosecute the thousands of 
subscribers who have purchased subscriptions to the websites in order to view 
the images. 

ICE Attache London received a request to investigate members of the network 
possibly using a mailbox at a MAILBOXES, ETC., facility located at 37 Store 
Street, London, England, to communicate with one another. 

On 12 Jun 07, ICE Attache London met with Detective rnnst-ahip I <bxs) <b)(7)(Q I n f 
the METPED who agreed to assist the investigation and determine the user/users 
of the mailbox and what is being sent form or received at the address. 

On 24 Jul 07, DC j |b>(G f g b>(7> l provided the following information. 

DC l |b>, 7n a>|/ 1 advised he interviewed I (b)(6), (b)(7)(C) | of Mailbox Etc.) who 

stated that the branch in question, 37 Store Street, closed down in September 
2003 . 

The Mailbox Etc stores are all franchised. The owner and franchi see of the 
store street location, when it was operational, is a man called | |b>( ‘*|.. ( l b>|/> | 

L (bxo (b)(7)(C) ~~| branch for 10 years, from September 19 93 until 

September 2003. The reason the Store Street branch closed was purely because 
the lease on the premises had expired. 

On expiration of the lease, Mr. l< b >< G >i b )(7)<c)| moved the business half a mile away to 
14, Tottenham Court Road, London, WIT 1JY. Mr. I mb) ( b)(7)(C) ~~| Mailboxes Etc. 

out of these premises, which he co- leases with 'Easy Internet Cafe' and 
'Subway' fast food chain. 

When the business moved premises, most of the clients moved their mailboxes 
and accounts, to the new branch at Tottenham Court Road. 

DC | |bn 7A D)1/) l advised he then interviewed C (b)(G> (b)(7)(C> 1 who checked his company 

records and confirmed that no one is currently renting a mailbox at the 
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nor has there ever been a Mailbox rented under either name at that branch. He 
stated that he would definitely remember if he had a client using an address 
of ■ Boi faah i a a he originates from Belfast himself. He also thought it strange 
that i | ( b >( 6 f » b > (7 > | , dici n it provide a Mailbox number to the payment processor {from 
whom this information originates) , as almost all of his clients use a mailbox 
number as opposed to a name, as a postal address. 


Mr. I (b)(6), (b)(7)(c)! agreed to research any records of customer accounts he had at the 
Store Street Branch. He stated this might take some time, as any Records he 
still has are paper records and not computerized. He also stated they are 
filed by Mailbox number as opposed to the renter's name. 


Mr. | (b)(6), (b>(7)(C)~| was wholly co-operative and is more than willing to assist law 
enforcement in any way he can. 


DC r n 7A° n/ 1 advised that Mr. I (b>(6>,(b>(7>(c> | agreed to do the research and contact him as 
soon as possible. 


DC r n 7r\° M,) l opined that it would help him support our investigation if we could 
determine when 'Slater' gave the payment processor this address. If it has 
been within the last 4 years then it might be difficult to trace since the 
branch has been closed for these 4 years. 


ICE Attache London will maintain this case as open to support additional 
requests from RAC Birmingham. 


Investigation continues. 
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INVESTIGATIVE FINDINGS 
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TOPIC: INTERVIEW OF I ( b >(6) (b)(7)(C) ~1 BY MET PEP 


SYNOPSIS: 

ICE RAC Birmingham and the ICE Cyber Crimes Center {C3) are conducting 
Operation Flicker, a joint investigation into numerous subjects in the United 
States, Great Britain, Russia, Belarus, and Latvia involved in distribution of 
child pornography through member-restricted Internet websites. 


This report documents the METPED interview of the branch manager of the 
MAILBOXES ETC., facility located at 37 Store Street, London, England. 
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ICE RAC Birmingham and the ICE Cyber Crimes Center (C3) are conducting 
Operation Flicker, a joint investigation into numerous subjects in the United 
States, Great Britain, Russia, Belarus, and Latvia involved in distribution of 
child pornography through member- restricted Internet websites. The primary 
focus of the first phase of the investigation is to identify and prosecute the 
manufacturers and distributors of the child pornography. The second phase of 
the investigation will be to identify and prosecute the thousands of 
subscribers who have purchased subscriptions to the websites in order to view 
the images . 


On 15 Aug 07, Detective Constable (DC) (bxs^bi mio I of t he METPED contacted ICE 
Attache London ho advise he interviewed a Mr. |(b>(S) (b>(7xc> | Q f MAILBOXES ETC., who 
stated he I (b>(6> (b>(7)(c> | Tottenham Court Road branch in 

London. Mr. | (b)(6), (b)(7)(C) | statpd he. had been the manager of the Store Street Branch 
while it was open. Mr. I (b>(B>,(b>(7>(c> | stated that "without a doubt "amail box was 
never opened at the Store Street branch under the name of ■■ r u ”7A u, ' ,, l 1 ' or 
"BELFAST" . He also stated that he has no records of the name at his current 
branch. Mr. Libxsiw^to] did state that if law enforcement could obtain a box 
number then he would search by box number to see if he can locate a history 
and match the names . 

DC P >|b ,n b>|/) | advised he would go back to MAILBOXES ETC., with any additional 
questions from RAC ICE Birmingham. 

ICE Attache London will maintain this case as open to support additional 
requests from RAC Birmingham. 
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COLLATERAL REQ: 


TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 


TOPIC: CASE CLOSED. 


SYNOPSIS : 

ICE RAC Birmingham and the ICE Cyber Crimea Center (C3) are conducting 
Operation Flicker, a joint investigation into numerous subjects in the United 
States, Great Britain, Russia, Belarus, and Latvia involved in distribution 
of child pornography through member-restricted Internet websites. 


ICE Attache London was contacted and requested the support of the London 
Metropolitan Police Service Pedophile Unit (METPED) to attempt tq identify 
the owner/user of a mail box located at the MAILBOXES ETC. , facility located 
at 37 Store Street, London, England. The user/owner is suspected of receiving 
payments for illegal subscriptions to child pornography web sites. 

The results of the METPED investigation were reported via I (b)(7)(E) | ROI 

#002 on 21 Aug 07 and the case was maintained open to support future 
investigation. No further requests are expected for ICE Attache London and in 
coordination with both RAC Birmingham and ICE C3, this case is being closed. 
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OTHER INFORMATION 



TOPIC: OPENING REPORT OF INVESTIGATION 



SYNOPSIS: 


In May 2007, the Special Agent in Charge, Denver, Colorado received 
information from ICE Cyber Crimes Center (C3) , Child Exploitation Section 
(CES) regarding Operation Flicker. In April 2006 C3 initiated an 
investigation into a criminal nr<y.-^p Ration . QPe rating a commercial child 
pornography website known as " lv<«^ • The investigation has 

revealed that the same organization is operating numerous commercial child 
pornography websites. In addition, the organization utilizes various PayPal 
accounts to process the payments for access to the member restricted websites. 

The investigation is being worked jointly with ICCE/C3/CES, 
ICE/RAC/Birmingham, the U.S. Postal Service, the U.S. Department of Justice 
(DOJ) , Child Exploitation and Obscenity Section (CEOS) . ICE has designated 
this operation as PROJECT FLICKER (2S2) . 

This report of investigation will serve as an opening report for the SAC 
Denver . 
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DETAILS OF INVESTIGATION 

In May 2007, the Special Agent in Charge, Denver, Colorado received 
information from ICE Cyber Crimea Center (C3) , Child Exploitation Section 
(CES) regarding Operation Flicker. In April 2006 C3 initiated an 
investigation into a criminal organ. i z at i on ope ra t i nq a commercial child 
pornography website known as ' U 'ZifyiiZZS'Si, I ' • The investigation has 
revealed that the same organization is operating numerous commercial child 
pornography websites. In addition, the organization utilizes various PayPal 
accounts to process the payments for access to the member restricted websites. 
The investigation is being worked jointly with ICCE/C3/CES, 

ICE/RAC/Birmingham, the U.S. Postal Service, the U.S. Department of Justice 
(DOJ) , Child Exploitation and Obscenity Section (CEOS) . ICE has designated 
this operation as PROJECT FLICKER j l w] . 

The information received from C3 has been disseminated the SAC Denver RAC 
offices for further investigation. A case will be opened for each individual 
subject from the FLICKER lead list. 

Investigation continues. 
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RELATED CASE NUMBERS: 
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OTHER INFORMATION 



| 

TOPIC: CLOSING REPORT OF INVESTIGATION 


SYNOPSIS: 

In May 2007, the Special Agent in Charge, Denver, Colorado received 
information from ICE Cyber Crimes Center (C3), Child Exploitation Section 
(CES) regarding Operation Flicker. In April 2006 C3 initiated an 
investigation into a criminal organisation ope rating a commercial child 
pornography website known as . The investigation has 

revealed that the same organization is operating numerous commercial child 
pornography websites. In addition, the organization utilizes various PayPal 
accounts to process the payments for access to the member restricted websites. 

The investigation is being worked jointly with ICCE/C3/CES, 
ICE/RAC/Birmingham, the U.S. Postal Service, the U.S. Department of Justice 
(DOJ) , Child Exploitation and Obscenity Section (CEOS) . ICE has designated 
this operation as PROJECT FLICKER (2S2) . 


This report of investigation will serve as a closing report for the SAC 
Denver . 
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DETAILS OF INVESTIGATION 

In May 2007, the Special Agent in Charge, Denver, Colorado received 
information from ICE Cyber Crimes Center (C3) , Child Exploitation Section 
{CES) regarding Operation Flicker. In April 2006 C3 initiated an 
investigation into a criminal organization ope rating a commercial child 
pornography website known as ' 1!°!^ . The investigation has 

revealed that the same organization is operating numerous commercial child 
pornography websites. In addition, the organization utilizes various PayPal 
accounts to process the payments for access to the member restricted websites. 
The investigation is being worked jointly with ICCE/C3/CES, 
ICE/RAC/Birmingham, the U.S. Postal Service, the U.S. Department of Justice 
(DOJ) , Child Exploitation and Obsc enity Section (CEOS) . ICE has designated 
this operation as PROJECT FLICKER I ltt ff ) . 

The SAC Denver will close this investigation at this time . 

Investigation closed. 
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CASE 

NUMBER | 
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TITLE : PROJECT FLICKER 


CASE STATUS: 

OPEN & CLOSE 




REPORT DATE 

DATE ASSIGNED 

PROG 

RAM CODE 

REPORT NO. 

070507 

060407 


[£] 

001 

RELATED CASE NUMBERS: 

COLLATERAL REQ: 

TYPE OF REPORT 





OTHER INFORMATION 




TOPIC: CLOSING OF CASE 


In April 2006,the ICE, Cyber Crimes Center (C3) , initiated an investloai^pn 
l,intQ u an ni^ahinn operating a child pornography website known as " In sc si 

ltd) c > hMv l g,ms^n 3 f i U er ■ This organization us ed various P ayPal accounts to process the 
payments for these websites. ASAC I (b>(6>,(b>(7>(c> \ (so) was provided with a list of 
subscribers in its area of responsi hi 1 i t y whn n aid for access to the child 
pornography websites. Special Agent (SA) I (b >( G >( b >( 7 >( c n of ASAC SO first divided up 
the subscriber lists into the areas contipHed—bii ASAC SO. Several leads were 
sent to RAC Stockton and RAC Reading. SA | < b » 6 > ( b >( 7 >(c> | then sent out Customs 
Summons' for all of the Internet Protocol Addresses and email addresses 
captured from the subscriber list provided by C3, as well as running public 
data base searches on the subscribers to pinpoint their location. ASAC SO will 
now be closing this case and opening local cases on individuals that are 
contacted regarding this information. This case number will be used for future 
subpoenas sent regarding subscribers . 

NO FURTHER DETAILS FOLLOW THIS SYNOPSIS. 




(b)(7)(E) j 
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SPECIAL AGENT 
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PAGE 1 

CASE NUMBER | (b)(7)(E) [ 

| TITLE: PROJECT FLICKER | 

CASE STATUS: 

INIT RPT 




REPORT DATE 

DATE ASSIGNED 

PROGRALl CODE 

r REPORT NO. 

061207 

060107 

m 

001 


RELATED CASE NUMBERS"! | (t»(6>, (b)(7)(C) 


COLLATERAL REQ: 


TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 


TOPIC: PROJECT FLICKER LEADS IDENTIFIED FOR SAC HOUSTON 


SYNOPSIS: 

In April 2006, the United States Immigration and Customs Enforcement {USICE) , 
Cyber Crimes Center (C3), Child Exploitation Section (CES) initiated an 
investigation into a criminal o r g an IzaJ t ion ope ra ting a commercial child 
pornography website known as " ES SS " The investigation has 
revealed that the same organization is operating numerous commercial child 
pornography websites. In addition, the organization utilizes various PayPal 
accounts to process the payments for access to the member- restricted websites. 

The investigation is being worked jointly with USICE/ C3CES , USICE RAC 
Birmingham, the U.S. Postal Inspection Service, the U.S. Department of Justice 
(DOJ) , Child Exploitation and Obscenity Section (CEOS) , and the United States 
Attorney's Office (USAO) for the Northern Dis trict of Alabama. USICE has 
designated this operation as Project Flicker d '° fV I) . 

On June 1, 2007, Senior Special Agent (SSA) | (b>(6>(b>(7>(c> | began to investigate 

Project Flicker leads located in the SAC Houston area of responsibility (AOR) . 



SIGNATURE- 

| (b)(7)(E) | 

1 (b)(6), (b)(7)(C) 1 SPEC I AT, AGENT 
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1 1 01 GRP SUPERVISOR 
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Details of Investigation: 


1. In April 2006, the United States Immigration and Customs Enforcement 

(USICE) , Cyber Crimes Center (C3) , Child Exploitation Section (CES) initiated 
an investigation into a cr imina 1 ^ o^^rn^a t operating a commercial child 
pornography website known as " IS “ The investigation has 

revealed that the same organization is operating numerous commercial child 
pornography websites. In addition, the organization utilizes various PayPal 
accounts to process the payments for access to the member- restricted websites. 
The investigation is being worked jointly with USICE/ C3/CES , USICE Resident 
agent in Charge (RAC) Birmingham, the U.S. Postal Inspection Service, the U.S. 
Department of Justice (DOJ) , Child Exploitation and Obscenity Section (CEOS) , 
and the United States Attorney's Office (USAO) for the Northern Di stri ct of 
Alabama. USICE has designated this operation as Project Flicker ( I'^VI ) . 

2. On June l, 2007, Senior Special Agent (SSA) I < b >< 6 >. ( b >( 7 >( c > | opened a 

collateral invest igation to pursue leads potentially located in the SAC 
Houston AOR. SSA n7A° n, j later contacted SSA | (b> ( 6> ( b> ( 7>(c> | at C3 who stated 

individual SAC Houston cases should be opened to invest igate suspects once a 
preliminary investigati on has validated each lead. SSA stated the 

information sent to SSA | (B>(t ? c ( >j was for the entire State of Texas and had not 
been divided into separate SAC AOR because of the high volume of leads. 

3. On June 8, 2007, SSA [^^3 completed identifying and dividing the leads 
for the SAC Houston, RAC Galveston, RAC Beaumont, and RAC Corpus Christ i 
offices. A total of approximately 106 Project Flicker targets were found in 
the information provided by C3 for USICE SAC Houston. 

4. SSA | ( 7-7»cfn compiled a Microsoft EXCEL spreadsheet for the 

based on the suspect’s address, and identified approximately 
the following counties: Brazos, Fort Bend, Harris, Houston, 

Montgomery, San Jacinto, and Trinity. 

5. SSA l (b>>G (c ( ) b>(7> | compiled a Microsoft EXCEL spreadsheet for the RAC Beaumont AOR, 

based on the suspect's address, and identified approximately eight suspects in 
the following counties: Angelina, Hardin, and Jefferson, 

6. SSA | (b (7»c^1 compiled a Microsoft EXCEL spreadsheet for the RAC Galveston 

AOR, based on the suspect’s address, and identified approximately nine 
suspects in the following counties: Brazoria, Galveston. 

7. SSA I I compiled a Microsoft EXCEL spreadsheet for the RAC Corpus 

Christ! AOR, based on the suspect's address, and identified approximately 
seven suspects in the following counties: Jackson, Nueces, and San Patricio. 

OFFICIAL USE ONLY 

THIS DOCUMENT IS LOANED TO YOU FOR OFFICIAL USE ONLY AND REMAINS THE PROPERTY 
OF THE DEPARTMENT OF HOMELAND SECURITY, ICE. ANY FURTHER REQUEST FOR 
DISCLOSURE OF THIS DOCUMENT OR INFORMATION CONTAINED HEREIN SHOULD BE REFERRED 
TO ICE HEADQUARTERS TOGETHER WITH A COPY OF THE DOCUMENT. 


SAC Houston AOR, 
82 suspects in 
Liberty, 


Page 780 of 929 




OFFICIAL USE ONLY 


DEPARTMENT OF HOMELAND SECURITY 

PAGE 4 

ICE 

CASE NUMBER 1 ] 

REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: 001 


8. SSA I ‘n'm 1 1 has begun to de -conflict the list of suspects for the SAC 
Houston Of fL ice an d will continue to gather information to substantiate each 
lead. SSA I I will send collateral requests to the RAC Beaumont, RAC 
Galveston, and RAC Corpus Chris ti offices once the Project Flicker leads and 
evidence are organized for those areas. This investigation continues. 
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CASE NUMBER 


TITLE : PROJECT FLICKER 

CASE STATUS: 

INTERIM RPT 



REPORT DATE 
071107 

DATE ASSIGNED 
060107 


REPORT NO. 
002 





RELATED CASE NUMBERS: 

COLLATERAL REQ 

RACPU RACGA RACCC 



TYPE OF REPORT 




COLLATERAL REQUEST / IN 



TOPIC: COLLATERAL REQUEST FOR PROJECT FLICKER TARGETS 


SYNOPSIS: 

In April 2006, the United States Immigration and Customs Enforcement (USICE) , 
Cyber Crimes Center (C3) , Child Exploitation Section (CES) initiated an 
investigation into a criminal operating a commercial child 

pornography website known as J,,. 1 11 The investigation has 

revealed that the same organization is operating numerous commercial child 
pornography websites . In addition, the organization utilizes various PayPal 
accounts to process the payments for access to the member-restricted websites. 

The investigation is being worked jointly with USICE/ C3 /CES , USICE RAC 
Birmingham, the U.S. Postal Inspection Service, the U.S. Department of Justice 
(DOJ) , Child Exploitation and Obscenity Section (CEOS) , and the United States 
Attorney's Office (USAO) for the Northern Dis trict of Alabama. USICE has 
designated this operation as Project Flicker {^3 . 


On June 1, 2007, Senior Special Agent (SSA) I (b)(6), (b)(7)(C) | began to investigate 

Project Flicker leads located in the SAC Houston area of responsibility (AOR) . 
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Details of Investigation: 


1. In April 2006, the USICE/C3/CES initiated an investigation into a c rimina l 
orcr^^ggt io n operating a commercial child pornography website known as " In ansi 

1 3snafr» rfhilri yirtm«.‘ I . " The investigation has revealed that the same organization is 
operating numerous commercial child pornography websites. In addition, the 
organization utilizes various PayPal accounts to process the payments for 
access to the member -restricted websites. The investigation is being worked 
jointly with USICE/ C3/CES , USICE Resident Agent in charge (RAC) Birmingham, 
the U.S. Postal Inspection Service, the U.S. Department of Justice (DOJ) , 

Child Exploitation and Obscenity Section (CEOS) , and the United States 
Attorney's Office (USAO) for the Northern Dis trict of Alabama. USICE has 
designated this operation as Project Flicker j ( ^ 7> ) . 

2. On June 1, 2007, Senior Special Agent (SSA) | (b>(6>,(b>(7>(c> | opened a 

collateral investigation to pursue leads potentially located in the SAC 
Houston AOR. The information received from C3 was for the entire State of 
Texas and had not been divided into separate SAC AOR because of the high 
number of leads . 

3. On July 10, 2007, SSA EE3 completed identifying and dividing the leads 
for the SAC Houston, RAC Beaumont, RAC Galveston, and RAC Corpus Christ i 
offices. A total of approximately 108 Project Flicker targets were found in 
the inf ormation provided by C3 . 

4 . SSA compiled a Microsoft EXCEL spreadsheet for the SAC Houston AOR, 

based on the suspect's address, and identified approximately 82 suspects in 
the following counties: Brazos, Fort Bend, Harris, Houston, Liberty, 

Montgomery, San Jacinto, and Trinity. 


COLLATERAL REQUEST RAC BEAUMONT 

5. SSA 1 (b mrc ( ) b> 1 compiled a Microsoft EXCEL spreadsheet for the RAC Beaumont AOR, 
based on the suspect's alleged address, and identified approximately eight 
susDPcts in the following counties: Angelina, Hardin, and Jefferson. SSA 

[_^__]will provide additional information upon request to the investigating 
agent. Due to the number of overall leads, SSA did not validate name, 

address, or e-mail information for suspects located in the RAC Beaumont AOR. 

It is requested RAC Beaumont investigate each lead and if the information is 
substantiated, an independent RAC Beaumont case be opened with p roject code 
2S2, Project Flicker. Additionally, evidence held by SSA exceeds 15GB 

of images and video from the various sites. This information will be provided 
to RAC Beaumont upon request of the assigned case agent. The suspect 
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information is as follows: 


1 

(b)(6), (b)(7)(C) 

|, Beaumont, TX 77706 


i 

(b)(6), (b)(7)(C) 

Beaumont, TX 77708 


1 

(b)(6), (b)(7)(C) 

1, Beaumont , TX 

77707 

1 

(b)(6), (b)(7)(C) 

1, Beaumont, TX 77708 

(Appears 

on Operation Yeti list) . 


1 

(b)(6), (b)(7)(C) 

|, Beaumont, TX 77705 


1 

(b)(6), (b)(7)(C) 

|, Groves, TX 77619 


i 

(b)(6), (b)(7)(C) 

1. Lufkin. TX 

75901 

1 

(b)(6), (b)(7)(C) 

|, Lumberton, TX 77657 


COLLATERAL REQUEST RAC GALVESTON 

6. SSA 1 1P m/i?n compiled a Microsoft EXCEL spreadsheet for the RAC Galveston 
AOR, based on the suspect's address, and identified approx ima t ej^_n±ne 
suspects in the following counties: Brazoria, Galveston, SSA I I will 

provide additional information upon reques t to the investigating agent. Due 
to the number of overall leads, SSA | w|b t cil did not validate name, address, or 
e-mail information for suspects located in the RAC Galveston AOR. It is 
requested RAC Galveston investigate each lead and if the information is 
substantiated, an independent RAC Galveston case be opene d with project code 
2S2 , Project Flicker. Additionally, evidence held by SSA f b)t 7n>1 exceeds 15GB 
of images and video from the various sites. This information will be provided 
to RAC Galveston upon request of the assigned case agent. The suspect 
information is as follows: 


czz 

77539 


ib)(G)(b)(7)<c) | . Alvin, TX 77511 

(b)(6), (b)(7)(C) | , Danbury, TX 77534 

(b)(6), (b)(7)(C) I , Dickinson, TX 


(b)(6), (b)(7)(C) 


Galveston, TX 77550 
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| (b)(6), (b)(7)(C) | , Galveston, TX 77550 

[ (b)(6), (b)(7)(C) |, League City, TX 

77573 


| (b)(6), (b)(7)(c) L League City, TX 77573 

(Appears on Project Flic ker target list and is a former Operation : Watchdog 
target, see closed case fl j (b)(7)(E) [ ) . 

| (b)(6), (b)(7)(C) | , Pearland, TX 77584 

| (b)(6), (b)(7)(c) | Santa Fe, TX 77510 


COLLATERAL REQUEST RAC CORPUS CHRISTI 

7. SSA r na /n° n/) l compiled a Microsoft EXCEL spreadsheet for the RAC Corpus 
Christi AOR, based on the suspect's address, and identified approximately nine 
suspec ts in the following counties: Jackson, Nueces, and San Patricio, SSA 

HB)(UMa)(/)| w: j_;Q provide additional information upon request to the investigating 
agent. Due to the number of overall leads, SSA did not validate name, 

address, or e-mail information for suspects located m the RAC Corpus Christi 
AOR. It is requested RAC Corpus Christi investigate each lead and if the 
information is su bstan tiated, an independent RAC Corpus Christi case be opened 
with project code Project Flicker. Additionally, potential evidence held 

by SSA I exceeds 15GB of images and video from the various sites. This 

information will be provided to RAC Corpus Christi upon request of the case 
agent. The suspect information is as follows: 

| _ (b)(6) ib)(7)(C) ~| . Corpus Christi, 

TX 78412 


1 = 

78404 


IZ= 

78413 

[= 


78418 


(b)(6), (b)(7)(C) 


(b)(6), (b)(7)(C) 


(b)(6), (b)(7)(C) 


Corpus Christi, TX 
Corpus Christi, TX 
Corpus Christi, TX 


I ,b)!G) ib)(?)(C: | , 

78401 


CorpuS Christi, TX 
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TITLE: PROJECT FLICKER 


CASE STATUS: 

INTERIM RPT 




REPORT DATE 

DATE ASSIGNED 

PROG 

CODE 

REPORT NO. 

100807 

060107 


m 

003 

RELATED CASE NUMBERS: 


COLLATERAL REQ : 


TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 


TOPIC: SAC HOUSTON PROJECT FLICKER TARGETS 


SYNOPSIS: 

In April 2006, the United States immigration and Customs Enforcement (USICE) , 
Cyber Crimes Center <C3) , Child Exploitation Section (CES) initiated an 
investigation into a criminal organization ope rating a commercial child 
pornography website known as " I (b)(7)(E) [ » The investigation has 

revealed this organization is operating numerous commercial child pornography 
websites. in addition, the organization utilizes various PayPal accounts to 
process the payments for access to the member- restricted websites. The 
investigation is being worked jointly with USICE/C3/CES , USICB RAC Birmingham, 
the U.S. Postal Inspection Service, the U.S. Department of Justice (DOJ) , 
Child Exploitation and Obscenity Section (CEOS) , and the united States 
Attorney's Office (USAO) for the Northern District of Alabama. 

Approximately 82 targets w ere ide ntified in the SAC Houston area of 
responsibility (AOR) . SSA I ‘TiurfH numbered each from F-l to F-44. The 
following serves to identify each target and the target's assigned number. 




J (b)(7)(E) 

] (b)(6), (b)(7)(C) | SPECIAL agent 


ftPPROVF.n- 

01 GRP SUPERVISOR 

ORIGIN OFFICE: HO 
HOUSTON, TX - SAC 

TELEPHONE : 281 981' A fra " ' 1 

typistTT’™! 
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Details of Investigation: 

, xn April 2006 , the United states Immigration and Customs En£°rcesmerit 
klSICP) ciber crimes Center <C3) , Child Exploitation Section (CES) initiated 
an investigation into a crimi 1 ^ ffiH ^|ation ^^^^^commerclal^h 

g^?ed P gLrtgri a r:; g ani te^M n g t ; r rous co r ereial 3 Child ai 
The investigation is being worked gointlywi the^ s ( Department of Justice 

^sr 9 Sid t ^oftaSS a L5 n sSc^?? y s s^ s, feces, - -£f-ss d h^ ates 

Attorney's Office (USAO) for the Northern Distinct of Alabama. USICE has 
designated this operation as Project Flicker 


joroximately 82 targets were identified in the SAC Houston AOR. SSA 
Pa rh p.ac Houston area of responsibility target fro™ |&(uj 1 (bx 1 yfj ) 

(b)(7)(E) 




(b)(7)(E) 



THIS DOCUMENT IS CE ^FURtZ r“ FOR 

nfoSSsSf 5™ LcSf® S™ CONTAINED HEREIN SHOULD BE REFERRED 

ZdquaSeL Together nith a copv of the document. 
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3. SSA intends to use local Internet Crimes Against Children (ICAC) , 

Houston Area Child Sexual Exploitation Task Force (HACSET) , and other local 
resources to assist with investigating many of the targets. If a target is 
discovered to be involved in any child exploitation offenses, (i.e., 
possession of, manufacture of, or distribution of child pornography, etc.) a 
separate case will be opened. If an interview or enforcement action occurs 
involving a target who is NOT found to be involved in child exploitation 
offenses, a report of investigation will be recorded under this SAC Houston 
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REPORT NUMBER: 003 


Project Flicker case 




This investigation continues 
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In April 2006, the United States Immigration and Customs Enforcement (USICE) , 
Cyber Crimes Center (C3) , Child Exploitation Section (CES) initiated an 
investigation into a criminal .n^an action ^ ope rating a commercial child 
pornography website known as " The investigation has 

revealed this organization is operating numerous commercial child pornography 
websites. In addition, the organization utilizes various PayPal accounts to 
process the payments for access to the member -restricted websites. USICE has 
designated this operation as Project Flicker d (I ?r 1 1 . 

During December 2007, USICE SAC Houston Special Agents met with local 
investigators to obtain assistance investigating the numerous Project Flicker 
leads in the Houston, Texas area. Details are contained herein. 
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Details of Investigation: 


1. In April 2006, the USICE/C3/CES initiated an investigation into a cr imina l 
organizatio n operating a commercial child pornography website known as " In r I 
I | . " The investigation has revealed that the same organization is 
operating numerous commercial child pornography websites. In addition, the 
organization utilizes various PayPal accounts to process the payments tor 
access to the member-restricted websites. The investigation is being worked 
jointly with US ICE/ C3/CES, USICE Resident Agent in Charge (RAC) Birmingham, 
the U.S. Postal Inspection Service, the U.S. Department of Justice (DOJ) , 

Child Exploitation and Obscenity Section (CEOS) , and the United States 
Attorney's Office (USAO) for the Northern District of Alabama. 


2. During December 2007, USICE SAC Houston Special Agents met with local 
investigators to obtain assistance investigating the numerous Project Flicker 
leads in the Houston, Texas area. 


3. On December 10, 2008, SSA l 
Fort Bend County Sheriff's Office (FBCSO) Sgt 


] an<i SSA I WW.WPXC) 

. I (b)(6) (b)(7)(G) T! 


I mp> with 
Sgt. |(b>(6),(b>(7)(C>| 


took working case file information for four Project Flicker targets and stated 
the individuals identified in the Project Flicker leads would be investigated 
by FBCSO personnel. The following targets, referenced by their Fli cker ID 

over to Sgt . | (b)(6), (b)(7)(C) | ; 

' Katy, TX 77450, 


number, name, 
F- 62 


w prp t-nri 


(b)(6), (b)(7)(C) 


~ned o 


jj, Missouri City, TX 


ILE 


(b)(6), (b)(7)(C) , Stafford, TX 77477, 

=T (also identified as Y-44) 


Sugar Land, TX 77478, 


(6) (b)(7)(C) 


(b)(6), (b)(7)(C) 


1 and SSA [ (b)(6) (b)(7)(C) | meL wlth 


Detective L 


(b)(6), (b)(7)(C) | tOOk 


4. On December 10, 2008, SSA I <5 

Kemah Police Department Detective | 
working case file information for five Project Flicker targets and stated the 
individuals identified in the Project Flicker leads would be investigated. 

The following targets, referenced by the ir Flicker I D number, name, address, 
and e-mail we re turn ed over tp Detective I (b>(6) (b)(7)(c) | : 

-1 f- .- ai .' Dl l I (b)(6), (b)(7)( c) (b)(6), (b)(7)(C) | , Baytown, TX 77521, 
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(b)(6) (b)(7)(C) r 

Baytown, TX 77521 


(b)(6), (b)(7)(C) 


F-3 (bus) (b)(7)(C) |, Baytown, TX 77521 

(b)(6), (b)(7)(C) I 1 


F-4 I (b)(6) (b)(7)(C) | , Baytown, TX 77521 

(b)(6), (b)(7)(C) 


F-40 (b)(6), (b)(7)(C) ~| / Houston, TX 77063 

(b)(6) (b)(7)(C) | 


5. On December 11, 2008, SSA I | met with Sgt . | (bxe>. wcxo I nf the 

Harris County Constable's Office, Precinct #4 (HCCO#4)7 Sgt. | (b)(6), (b)(7)(C) took 
working case file information for three Project Flicker targets and stated the 
individuals identified in the Project Flicker leads would be investigated. 

The following targets, referenced b y their F licker ID number, name, address, 

and e-mail wer.p Mirncd over fn Sat I (b > (B > (b>( 7 >< c >j : 

F- 60 ( (b)(6) (b)(7)(C) | , Humble, TX 77338 

| (b)(6)(b)(7)(C) | 


F- 61 


(b)(6) (b)(7)(C) | , Humble, TX 7734 6 

(b)(6), (b)(7)(C) I 


6 . USICE SAC Houston Agents will continue to seek assistance from local law 
enforcement agencies to investigate Project Flicker leads as necessary. A3 
cases are disseminated to other agencies such activity will be documented in 
future Reports of Investigation (ROIs) . This investigation continues. 
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CASE NUMRErI (b)(7)(E) [~ 

TITLE: PROJECT FLICKER 

CASE STATUS: INTERIM RPT 

REPORT DATE DATE ASSIGNED 

020909 060107 


RELATED CASE NUMBERS: 


COLLATERAL REQ: 


TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 


TOPIC: PROJECT FLICKER UMBRELLA INVESTIGATION PLACED IN PENDONG STATUS 


SYNOPSIS: 


In April 2006, the United States Immigration and Customs Enforcement {USICE), 
Cyber Crimes Center (C3) , Child Exploitation Section (CES) initiated an 
investigation into a criminal yMseafl fcaaL jgn ope ra t- -i no a commercial child 
pornography website known as ' Iv'cm, 1 m 'll l " In addition, the organization 
utilizes various PayPal accounts to process the payments for access to the 
member-restricted websites. The investigation is being worked jointly with 
USICE/C3CES, USICE RAC Birmingham, the U.S. Postal Inspection Service, the 
U.S. Department of Justice (DOJ) , Child Exploitation and Obscenity Section 
(CEOS), and the United States Attorney's Office (USAO) for the Northern 
D^l^ ict of Alabama. USICE has designated this operation as Project Flicker 


As of February 2009, the USICE SAC Houston Cyber Crimes Group continues to 
investigate suspects listed in the Project Flicker case. This umbrella case 
is being placed in pending status. 
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Details of Investigation: 

1. In April 2006, the United States Immigration and Customs Enforcement 
{USICE) , Cyber Crimes Center (C3) , Child Exploitation Section (CES) initiated 
an investigation into a crimi n al organi za t ion operating a commercial child 
pornography website known as " | V iS and cw 1S 8 T nphtll - " The investigation has 
revealed that the same organization is operating numerous commercial child 
pornography websites. In addition, the organization utilizes various PayPal 
accounts to process the payments for access to the member -restricted websites. 
The investigation is being worked jointly with USICE/C3/CES, USICE Resident 
agent in Charge (RAC) Birmingham, the U.S. Postal Inspection Service, the U.S. 
Department of Justice (DOJ) , Child Exploitation and Obscenity Section (CEOS) , 
and the United States Attorney's Office (USAO) for the Northern D istri ct of 
Alabama. USICE has designated this operation as Project Flicker {^J . 

2. Since September 2008, the USICE SAC Houston Cyber Crimes Group has 
coordinated with the Harris County District Attorney's Office to prepare 
search warrant affidavits for some of the suspects identified in Project 
Flicker. 

3. On December 17, 2008, USICE SAC Houston r.vhpr r.r imps agents conduct- ed n . 

.search .warrant nneral.ion at the residence of L (b)(6), (b)(7)(C) | 

| (b)(6), (b)(7)(C) |, Houston, Texas 77036. \ (b)(6) (b)(7)(C) | is identif ied on the 

USICE SAC Houston FLICKER suspect list as F-48 fl (b)(6) (b)(7)(C) | is his 

spouse) . A deskt op computer was seized on consent from a local computer 
repair shop. SSA I wig) (bir/xc) I ; R the case agen t and the USICE SAC Houston 
independent case for i (b)(6), (b)(7)(C) | j s | (b)(7)(E) | . 

4. On February 5, 2009, SSA moved the Project Flicker umbrella case to 

pending status. USICE SAC Houston agents will continue to coordinate with 
state and local investigators regarding the Project Flicker suspect list. 

This investigation continues. 
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In April 2006, the United States Immigration and Customs Enforcement (USICE) , 
Cyber Crimes Center {C3), Child Exploitation Section (CES) initiated an 
investigation into a criminal praanization ope rating a commercial child 
pornography website known as " In addition, the organization 

utilizes various PayPal accounts to process the payments for access to the 
member- restricted websites. The investigation is being worked jointly with 
USICE/C3CES, USICE RAC Birmingham, the U.S. Postal Inspection Service, the 
U.S. Department of Justice (DOJ) , Child Exploitation and Obscenity Section 
(CEOS), and the United States Attorney’s Office (USAO) for the Northern 

jrict of Alabama. USICE has designated this operation as Project Flicker 


D istr ic 


As of February 2010, the USICE SAC Houston Human Rights / Cyber Crimes Group 
continues to investigate suspects listed in the Project Flicker case. This 
umbrella case remains in pending status. Details are contained herein. 
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Details of investigation: 

1. In April 2006, the United States Immigration and Customs Enforcement 
(USICE) , Cyber Crimes Center (C3) , Child Exploitation Section (CES) initiated 
an investigation into a crimi nal orga ni z a t i on operating a commercial child 
pornography website known as " l„S Lnj" l “ The investigation has 
revealed that the same organization is operating numerous commercial child 
pornography websites. In addition, the organization utilizes various PayPal 
accounts to process the payments for access to the member- restricted websites. 
The investigation is being worked jointly with USICE/ C3/CES , USICE Resident 
agent in Charge (RAC) Birmingham, the U.S. Postal Inspection Service, the U.S. 
Department of Justice (DOJ) , Child Exploitation and Obscenity Section (CEOS) , 
and the United States Attorney's Office (USAO) for the Northern Dist ri ct of 
Alabama. USICE has designated this operation as Project Flicker | ( ^ 7> | . 

2. On February 5, 2009, USICE SAC Houston SSA moved the Project Flicker 

umbrella case to pending status. USICE SAC Houston agents have continued to 
coordinate with state and local investigators regarding the Project Flicker 
suspect list. 

3. Since the inception of this case, most of the approximately 82 SAC Houston 
Project Flicker targets have been encountered through search warrants, consent 
searches, border search authority, and other law enforcement encounters. 
Several Project Flicker targets have moved from the SAC Houston area of 
responsibility and a few others are reported as deceased. Some Project 
Flicker targets were never completely identified, possibly due to fraudulent 
purchaser information entered by the user(s). 

4. Project Flicker targets who were found to substantiate a search warrant 
and / or were found to be in possession of child pornography / child abuse 
images have resulted in independent investigative case openings. Most of 
these independent investigations have resulted in the prosecution of Project 
Flicker targets for possession of child pornography. 

5. Because there are still Project Flicker targets in the SAC Houston AOR, 
this umbrella investigation will remain in pending status. The information 
contained in the Project Flicker umbrella case file has proven useful during 
several investigations where Project Flicker targets have been the subject of 
newer child pornography target lists. This has allowed investigators to use 
Project Flicker lead information in addition to the newer lead information to 
establish a history of "child pornography collector" behavior. When such 
"child pornography collector" history is demonstrated, search warrants are 
more likely to be issued by State or Federal magistrates. 
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6 . On ffphmarjf i -?m n gqa j ( '| transferred an external hard drive to Group 
SLLLiaexiziapr (GS) | (b)(6), (b)(7)(c) | tor use in future investigations (CBP Form 6051S 

ffl (b>(7>(e> |) _ The Project Flicker images, videos, website graphics, and 
purchaser information on the portable hard drive is being retained in the 
Project Flicker umbrella case for use if / when a target becomes the subject 
of a subsequent child pornography user / purchaser list. This cage remains in 
pending status . 
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Operation "Flicker" is a joint investigation between RAC/Birmingham, the 
ICE-C3 unit, the U.S. Postal Inspection Service, and the Department of Justice 
that targets both the principles facilitating subscription payments as well as 
the actual subscribers to several child exploitation websites. RAC/NY AIRG 
was tasked, via collateral request, to support the investigation by 
identifying assets for potential forfeiture with respect to three individuals 
living in the New Y ork City area wh o are suspected of being directly involved 
in the scheme, flee I ib " 7l!El I for case related ROIs. A collateral 

investigation was opened in the RAC/NY AIRG on 06-25-2007. 
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CASE NUMBER I (b>(7>(E> ' 


REPORT NUMBER: 001 


Three subjects living in or near the New York City are believed to be the 
controllers of or are facilitating payments for chil d pornography we bsites via 
the "Pay Pal" on-line payment transfer system. (See I (b>(7>!E > 1 for 

complete details.) The subjects are identified as follows: 


Name : 
Address : 
e-mail : 


Name: 
Address : 

(b)(6), (b)(7)(C) 

, Woods ide, N 
, Astoria, NY 

e-mail : 

1 (b)(6), (b)(7)(C) 1 


i mmw) 

i 

Bank : 

JP Morgan/Chase : 
JP Morgan/Chase : 

(b)(6), (b)(7)(C) 


Name : 1 

(b)(6), (b)(7)(C) I 


1 

(b)(6), (b)(7)(C) 

1 


(b)(6), (b)(7)(C) 


Bank: 

Netbank: 

(bX6),(bX7MC> 

] 


Jamaica, NY, 11435 


(b)(6), (b)(7)(C) 

, El 

1 (b)(6) (b)(7)(C) 1 

(b)(6), (b)(7)(C) 



Flushing. NY 


Fort Sill National Ba nk: 
PNC Bank: | (b)(6) (b)(7)(cn 


The financial status of these subjects is nor, yet known. A database search 
request was submitted to "DynCorp" analyst, I (b>(B>(b>(7>(c> | , on 06-25-2007 in 

order to obtain preliminary information regarding the identification of 
forfeitable assets should any or all of the subjects be indicted. All three 
subjects are being queried in individual requests. This case is pending. 
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TOPIC: CLOSING ROI ; OPERATION FLICKER 


SYNOPSIS: 

Operation "Flicker" is a joint investigation between RAC/Birmingham, the 
ICE-C3 unit, the U.S. Postal Inspection Service, and the Department of Justice 
that targets both the principles facilitating subscription payments as well as 
the actual subscribers to several child exploitation websites. RAC/NY AIRG 
was tasked, via collateral request, to support the investigation by 
identifying assets for potential forfeiture with respect to three individuals 
living in the New Y ork City area wh o are suspected of being directly involved 
in the scheme. See I < b >< 7 >< E > 1 for case related ROIs. A collateral 

investigation was opened in the RAC/NY AIRG on 06-25-2007. 
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DETAILS OF THE INVESTIGATION 


The AIRG portion of the "Operation Flicker" investigation focused upon the 
financial, address, and property statuses of three individuals identified in 
the collateral request. B v Q7-Q1-2Q07. asset profiles were compiled for the 
following th ree subjects: 1 (a>(6> (b)(7)(C) | 

| (b)(6), (b)(7)(c) | The results of th e AIRG analyses were shared with the criminal 

case agent, | mmwnc) |. No further queries were conducted beyond the 

preliminary profiles . 

On 09-20-2007, case closure was recommended by the criminal case agent as the 
three individuals named above were no longer perso ns of interest or subjects of 
the larger, continuing investigation, ( b >< 6 > (b)(7)(C) | . » 

AIRG case number | (b)(7)(E) ] is hereby closed. 
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In April 2006, U.S. Immigration and Customs Enforcement (ICE), Cyber Crimes 
Center (C3) , Child Exploitation Sections (CES) , initiated an investigation 
into a cr i mir^al^ oraani zat i on operating a commercial child pornography website 
known as " The investigation revealed the same organization 

operates numerous commercial child pornography websites. The investigation 
has been designated as PROJECT FLICKER. 

On June 18, 2007, RAC/AU initiated an investigation with regards to the 
subjects within RAC/AU’ s area of responsibility. PROJECT FLICKER provided 
RAC/AU with a spreadsheet detailing transaction logs related to approximately 
forty (40) subscribers of child pornography websites. The transaction logs 
included information such as date of purchase, time of purchase, name of 
purchaser, IP addresses, email addresses, and shipping addresses. RAC/AU will 
utilize this information to identify and prioritize subjects of this 
investigation. 
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| REPORT NUMBER: 001 


DETAILS OF INVESTIGATION: 


In April 2006, U.S. Immigration and Customs Enforcement (ICE), Cyber Crimes 
Center (C3) , Child Exploitation Sections (CES) , initiated an investigation 
into a c r im i na 1 o r g an i z a t i on operating a commercial child pornography website 
known as ^jUTl " The investigation revealed the same organization 

operates numerous commercial child pornography websites. In addition, the 
organization utilizes various PayPal accounts to process the payments for 
access to the member restricted websites. The investigation has been 
designated as PROJECT FLICKER. 

On June 18, 2007, RAC/AU initiated an investigation with regards to the 
subjects within RAC/AU' s area of responsibility. PROJECT FLICKER provided 
RAC/AU with a spreadsheet detailing transaction logs related to approximately 
forty (40) subscribers of child pornography websites. The transaction logs 
included information such as date of purchase, time of purchase, name of 
purchaser, IP addresses, email addresses, and shipping addresses. RAC/AU will 
utilize this information to identify and prioritize subjects of this 
investigation . 

Senior intelligence Research Specialist (SIRS) , I ib)(6), (b)(?)(C) ~1 . has prepared 

and submitted numerous Summonses with regards to email addresses, IP 
addresses, login dates and times, in an attempt to identify and or confirm the 
identity of the subjects of this investigation. 


Three (3) subjects have been identified as subscriber s to child pornogra phy 
websites throug h Opera l-inn Em i ssa ry These subjects, I (b)(6) (b)(7)(C) l 

I (b>(6>, (b)(7)(C) f and I (b)(6)(b)(7)(c> | have been assigned and are being 

investigated under separate case numbers. 

This investigation is ongoing. 
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TOPIC: CLOSING REPORT. 


SYNOPSIS: 

In April 2006, Immigration and Customs Enforcement (ICE), Cyber Crimes Center 
(C3 ) , Child Exploitation Section (CES) , initiated an investigation into a 
cri minal organizatio n operating a commercial child pornography website known 


i vintim<. n n„ nnh.1 " • The investigation revealed the same organization 
operates numerous commercial child pornography websites. The investigation has 
been designated as Project Flicker. 


On June 18, 2007, Immigration and Customs Enforcement (ICE) , Resident Agent in 
Charge, Austin, Texas (RAC/AU) initiated an investigation with regards to the 
subjects within RAC/AU' s area of responsibility. This report lists which 
agency's and specific agents were assigned various targets of this 
investigation. 
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This investigation is now closed. 
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Project Flicker was a National investigation initiated by ICE HQ C3 conc erning 
Child Explo itation and a known Child Pornographic series known as ' jij s 3 c | 

I aaaS SmSS t 1 - 

All leads have been pursued and enforcement actions taken. No further 
activities are anticipated in regards to this investigation. In the event 
additional lead information is received - the SAC/Chicago investigation will 
be re-opened. 

Investigation is closed. 
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RELATED CASE NUMBERS: 


COLLATERAL REQ: 


TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 


TOPIC: INITIAL REPORT / PROJECT FLICKER / RAC/ PORTLAND, MAINE 


SYNOPSIS: 

Based on investigative leads forwarded by U.S. Immigration and Customs 
Enforcement (ICE), Cyber Crimes Center (C3) , Child Exploitation Section (CES) , 
the RAC/Portland has initiated an investigation into several individuals 
residing within southern and central Maine who are suspected of purchasing 
memberships to internet web sites containing child pornography. The leads were 
forwarded by ICE/C3/CES under Project FLICKER. 


The ICE/C3/CES investigation has identified that a specific criminal 
organization is operating over 18 different commercial child pornography 
advertising websites which provide access to over 18 child pornography member 
restricted websites. The investigation has identified a group of individuals 
within the U.S. that own and control numerous PayPal accounts which are being 
utilized to facilitate the customer payments for the child pornography 
websites . 
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REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: 001 


DETAILS OF INVESTIGATION: 


Based on investigative leads forwarded by U.S. Immigration and Customs 
Enforcement (ICE), Cyber Crimes Center (C3), Child Exploitation Section (CES) , 
the RAC/Portland has initiated an investigation into several individuals 
residing within southern and central Maine who are suspected of purchasing 
memberships to internet web sites containing child pornography. The leads were 
forwarded by ICE/C3/CES under Project FLICKER. 

The ICE/C3/CES investigation has identified that a specific criminal 
organization is operating over 18 different commercial child pornography 
advertising websites which provide access to over 18 child pornography member 
restricted websites. The investigation has identified a group of individuals 
within the U.S. that own and control numerous PayPal accounts. The PayPal 
accounts are being utilized to facilitate the customer payments for the above 
listed child pornography websites. The owners of the PayPal accounts use 
specific subject identifiers to indicate which member restricted website the 
customer has purchased access to. Project FLICKER has generated approximately 
5,000 domestic subscriber leads to date. > 

RAC/Portland received leads on sixteen targets identified by C3 during the 
cours e of the invest igation. RAC/Portland Intelligence Research Specialist 
(IRS) | (b)(6), (b)(7)(C) | queried the supplied list of targets through various 

Department of Homeland Security databases, in addi tion to conducting public 
record searches on the subjects. Also, IRS I I queried the Maine Sex 

Offender Registry for presence of target names and for past criminal history. 
Of the sixteen, four targets were determined to be living in areas outside of 
the RAC/Portland area of responsibility. These target leads will be forwarded 
to the appropriate ICE Office of Investigations office with responsibility 
over the last known address of the subject. 

RAC/Portland S/A I _ (b>(G> (b>(7xc> | deconf lie ted the target names through the 

Maine Computer Crimes Task Force, FBI/Portland, and the National center for 
Missing and Exploited Children. 

The remaining targets have been disseminated among the RAC/Portland Special 
Agents for investigation. Any enforcement action taken on an individual target 
and subsequent prosecution will be reported under a separate, individual case 
number . 

Investigation by the RAC/Portland continues. 
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REPORT NO. 
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l 

| INVESTIGATIVE FINDINGS 





I 


TOPIC: PROJECT FLICKER - RAC/PORTLAND, MAINE CLOSING REPORT 


SYNOPSIS: 

Based on investigative leads forwarded by U.S. Immigration and Customs 
Enforcement (ICE), Cyber Crimes Center (C3), Child Exploitation Section (CES) , 
the RAC/Portland has initiated an investigation into several individuals 
residing within southern and central Maine who are suspected of purchasing 
memberships to internet web sites containing child pornography. The leads were 
forwarded by ICE/C3/CES under Project FLICKER. 

The ICE/C3/CES investigation has identified that a specific criminal 
organization is operating over 18 different commercial child pornography 
advertising websites which provide access to over 18 child pornography member 
restricted websites. The investigation has identified a group of individuals 
within the U.S. that own and control numerous PayPal accounts. The PayPal 
accounts are being utilized to facilitate the customer payments for the above 
listed child pornography websites. 
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CASE NUMBER | (b)(7)(E) 

REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: 012 


DETAILS OF INVESTIGATION: 

Based on investigative leads forwarded by U.S. Immigration and Customs 
Enforcement (ICE) , Cyber Crimes Center (C3) , Child Exploitation Section (CES) , 
the RAC/Portland has initiated an investigation into several individuals 
residing within southern and central Maine who are suspected of purchasing 
memberships to internet web sites containing child pornography. The leads were 
forwarded by ICE/C3/CES under Project FLICKER. 

The ICE/C3/CES investigation has identified that a specific criminal 
organization is operating over 18 different commercial child pornography 
advertising websites which provide access to over 18 child pornography member 
restricted websites. The investigation has identified a group of individuals 
within the U.S. that own and control numerous PayPal accounts. The PayPal 
accounts are being utilized to facilitate the customer payments for the above 
listed child pornography websites. The owners of the PayPal accounts use 
specific subject identifiers to indicate which member restricted fi/ebsite the 
customer has purchased access to. Project FLICKER has generated approximately 
5,000 domestic subscriber leads to date. 

RAC/Portland received leads on sixteen targets identified by C3 during the 
course of the investigation. RAC/Portland Criminal Research Specialist (CRS) 

| (b)(6) (b)(7)(C) ~| queried the supplied list of targets through various Department 

of Homeland Security databases, in a ddition to conducting public record 
searches on the subjects. Also, CRS I lL »7 r \ u,|,) | queried the Maine Sex Offender 
Registry for presence of target names and for past criminal history. Of the 
sixteen, four targets were determined to be living in areas outside of the 
RAC/Portland area of responsibility. These target leads will be forwarded to 
the appropriate ICE Office of Investigations office with responsibility over 
the last known address of the subject. 

Targets of the investigation which resulted in further investigative activity 
have been documented under individual cases. All investigative activity on the 
other target leads has been exhausted. No further investigative activity is 
anticipated under the general case. Therefore, the investigation is closed. 
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In April 2006, ICE Cyber Crimes Center initiated an investigation into a 
■— P n operating a commercial child pornography website known 
as " I victims chiM nnhil I . " The investigation has revealed that the same 
organization is operating numerous commercial child pornography websites. The 
investigation is being worked jointly with ICE Cyber Crimes Center; 
RAC/Birmingham; U.S. Postal Inspection Services; the U.S. Department of 
Justice, Child Exploitation and Obscenity Section; and the U.S. Attorney's 
Office for the Northern District of Alabama. ICE has designated this PROJECT 
FLICKER. 

This case exists to document general enforcement and support duties leading to 
the identification and assessment of those PROJECT FLICKER Wisconsin leads. 
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(b)(7)(E) | 

I (b)(7)(E) [ The investigation has 

identified that a specific criminal organization was operating approximately 
18 different commercial child pornography websites, which provide access to 
child pornography member restricted websites. This criminal organization has 
utilized a specific and identifiable payment website known as " iWest." The 
information developed during the course of the investigation has identified 
that the organization utilized various PayPal accounts to facilitate the 
customer payments. The organization uses specific subject identifiers within 
the PayPal accounts to identify purchases into the various member restricted 
websites, and uses specific administrative e-mail accounts that are used to 
distribute access to the member restricted websites. 

2. Senior Special Agent 1~ (b)(6),(b)(7xo | has been assigned as the Point of 

Contact for Project Flicker for the Wisconsin leads. SSA was provided 

a spreadsheet with 88 wi gcongjn individuals who accessed these child 
pornography websites. SSA will attempt to further identify these 

individuals and de-conflict with the Wisconsin ICAT agencies. Individual 
investigative case will be opened to track all enforcement activities for each 
target . 
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crimi nal prcranizat io n operating a commercial child pornography website known 
as " LS’ nXJ . 11 Enforcement activities fall under PROJECT FLICKER. 

On September 12, 2007, the RAC/Milwaukee advised the RAC/Fort Pierce of a Fort 
Pierce, Florida resident that has been identified as a Project Flicker target. 
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DETAILS OF INVESTIGATION 


Qn September 12, 2QQ.7, Special Agent | 


(b)(6), (b)(7)(C) "1 contact 

I ---I a dvised SA^ 


T fa 


Agent I (b)(6), (b)(7)(C) | . RAC/Fort Pierce. SA I 

that RAC/Milwaukee received Project F licker i nformation on r < b >t 6 H b >( 7 >( c > . 
resident o f Fort , Pierc e. Flori da. SA | (b>(fa ?n b>(/> I electronically sent all data 
g l (b>S (cf >(7> l to sa l 1 — “ — 1 




2 . 




] will also send a hard copy of the Project Flicker information 


on | w 7c)l to the RAC/Fort Pierce along with this ROI 
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In April 2006, ICE Cyber Crimes Center initiated an investigation into a 
cri minal oraani .Tiati o n operating a commercial child pornography website known 
as and^chiid wifriesses 1 milts ! • 11 Enforcement activities fall under PROJECT FLICKER. 

On September 12, 2007, RAC/Milwaukee submitted all the Wisconsin PROJECT 
FLICKER names and screen names to the National Center for Missing and 
Exploited Children. NCMEC was asked to determine if any of names and/or 
screen names had any additional information concerning these individual r . On 
September 17, 2007, NCMEC responded with electronic report number [ wcxe) | . 
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DETAILS OF INVESTIGATION 


1. On September 12, 2007, SSA I lu, 7A un7r l submitted 79 Wisconsin PROJECT 

FLICKET names and screen names to the National Center for Missing and 
Exploited Children. NCMEC was asked to determine if any of names and/or 
screen names had any ad ditional information concerning these individ uals . On 
Sept ember 17. 2007, SSA | | received an electronic NCMEC report # | (b)(7)(E) | 

from | (b)(B), (b)(7)(c) | . 


Report # | (b)(7)(E) | indicated possible additional information on the 

na nampfl :~l (b)(6), (b)(7)(C) 


following name. 


7 


located on the other submitted names. 


r 


No additional information was 


3 NCMEC 's report stated law enforcement contacts and possible web sites 
that these individuals owned/ were associated with. NCMEC 's report also 
indicated the following statement, "I cannot confirm this individual is the 
same as the current target." 

4 . SSA | | w i^]_ contact the law enforcement agencies noted in the 

report to verify the information and/or provide the PROJECT FLICKER 
information on that target for their use. If PROJECT FLICKER information is 
provided to the law enforcement entities, a report of investigation on that 
specific target will be documented. Subject records on the individuals listed 
in paragraph 2, will be created and linked to each specific report. 

5. | (b)(6) (b)(7>(c> | i s facing Wisconsin State cha rges in Mi lwaukee and 

Ozaukee Counties on posses sion of child porn ography. 1 < b >(6>.(b>(7>(c> | was a target 
in Operation Emissary, SSA I < b >( G >< b >< 7 >(C) | i s the DHS-ICE case agent. 

6. | (b>(6> (b)(7)(c) | wa s at- a ra nt in Operation Falcon and Operation Emissary. 

On February 24, 2007, I ! F consented to a digital inspectipn of his 

computers. No child pornography was located. SSA I (b>(6>,(b>(7)(c> | is the DHS-ICE 
case agent. 

7. | (b)(6> (b)(7)(C) ~| was a target in Operation Emissary. SSA I (b)(6), (b)(7>(c> | j. s 

the DHS-ICE case agent. 
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In April 2006, ICE Cyber Crimes Center initiated an investigation into a 
<- r-i mi nai v.n t- \ p n operating a commercial child pornography website known 

as 1 victims and child Lmes^s ^g'his I - " Enforcement activities fall under PROJECT FLICKER. 


On October 3, 2007, a Cudahy PROJECT FLICKER target was referred to the Cudahy 
Police Department. The Cudahy Poli ce Department will attempt to obtain a 
search warrant for the residence of I (b»iB) (b)<7)(c> | . 
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1 On October 3 2HH2 g-gft I ( b » 6 > (b>(7xc> I turned over all PROJECT 

FLICKER data on I ,i^ (6> (b>(7>(C> I; Cudahy, Wisconsin, to Lt . 

[ (b)(6), (b)(7)(C) I , Cudahy Police Department. 

2, Lt. | rorcEMTT | advi rpH .qfiA I |BXb) A an/) | that they will attempt to obtain a state 

search warrant for | (b)(6), (b)(7)(c) | residence. 
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targets residing within the AOR of RAC/Milwaukee. 
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INVESTIGATIVE FINDINGS 


TOPIC: MINNESOTA PROJECT FLICKER TARGET 


SYNOPSIS: 

In April 2006, ICE Cyber Crimes Center initiated an investigation into a 
crimin al organizatio n operating a commercial child pornography website known 
as " |J " ICE has designated this PROJECT FLICKER. 

On October 5, 2007, the RAC/Milwaukee advised the SAC/Minnesota that a Chaska, 
Minnesota resident has been identified as a Project Flicker target. 
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DETAILS OF INVESTIGATION 


1. On October 5, 2007, Senio r Special Agent 1 H contacted 

Senior Special Agent f (b)(6), (b)(7)(c) | , SAC/Minnesota . SSA I tc i ladvised SSA | I 
that RAC/ Milwaukee received Project Flicker information on I (b)(6) (b)(7)(C) | 

| (b)(B> (b)(7>(cT~| . a resident of Chaska, Minnesota. Project Flic ker inform ation list. a 
Chaska, Minnesota and R i Fa 1 1 s . wi sr.nnsi n address for I (bxs) (b>(?>(c> [ 1 (b>(6 > (b)(7)(C) | 
used the IP address of I (bxeywaxc) | on February 19, 2007, and listed the 
River Falls address. According to the WHOIS database, Comcast Cable 
Comimini oahi nn s Holding M.innesota-6 utilizes the Internet Protocol address 
range between I (b>(G> (b>(7xc> | , 

2 According to Accurint report r an on October 4, 2007, | (b)(6) (b)(7)(C) | 

| (b)(6), (b)(7)(C) | res ides at I (b)(6) (b)(7)(C) |. cha ska. Minnesota, 55318. I ( b )( 6 >( b >(7)(C) | 

driver's license number is I (b)(7)(E) |. a nd his DOB is I (b)<s> (b>(7xc> | . No 

Accurint reports were located for I (b)(6).(t»(7)(Q | a t the River Falls, Wisconsin 
address. No Wisconsin driver's license number was located. 

Y I (b)(6) (b)(7)(C) | used t he nam e IP add ress on February 25, 2007, to access 
H (b)(6).(b)(7)(c> I " . SSA I | has requested the two different PayPal 

Account numbers listed for these two dates. 

A SSA I <a)<b , ) n l ' a)(/) | will send a hard copy of the Project Flicker informa t inn nn . 

| (b)(6), (b)(7)(C)| (- 0 t he RAC/Minnesota along with this information report. SSA | ^ | 

will electronically send the Paypal information to the SAC/MS when it becomes 
available. 
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In April 2006, ICE Cyber Crimes Center initiated an investigation into a 
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as 11 Enforcement activities fall under PROJECT FLICKER. 


On October 18, 2007, three PROJECT FLICKER targets were referred to the 
University of Wisconsin, Madison Police Department. All three targets 
util ized the University of Wiscons in's e-mail services • The three targets 
were | WW (b)(7)(C) | , and | (b)(6), (b)(7)(C) | . 
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DETAILS OF INVESTIGATION 


1. On October 18, 2007 SSA I I re ferred three PROJECT FLICKER targets 

were referred to Detective I (bxs> (b)<7xc> [ university of Wisconsin, Madison 

Police Department. All three targets ut ilized the University of Wiscon sin's 
.e-mail service s. The three tarqets were I (b)(B>, (b)(7)(C) |, | (b)(6), (b>(7>(c> [ and 

| (b)(6) (b)(7)(C) | 

2 . On Octob er 18. 2007. SS A I tbxe) tbxzxo | turned ov er all PRO JECT 

FLICKER data on I ( b >< 6 > (b)(7)(c) | and ! ( b >( 6 > (b)(7)(C) I. ho Detective | (b)(6), (b)(7>(c> | , SSA 

| (D)|BHb)[/) j an ti c ip a t e turning all the on | (b)(6) (b)(7xo | later this month, when it 

is received from PayPal. 

r}b>(lihb>( 7 i I Detective 1 (b)(6).(b)(7)(C)"| anticipates conducting a enforcement on I W T° n/) | 

I let I within the next two weeks. | (b>(6> (bxzxo | is employed by the University 

as a financial advisor. 


OFFICIAL USE ONLY 

THIS DOCUMENT IS LOANED TO YOU FOR OFFICIAL USE ONLY AND REMAINS THE PROPERTY 
OF THE DEPARTMENT OF HOMELAND SECURITY, ICE. ANY FURTHER REQUEST FOR 
DISCLOSURE OF THIS DOCUMENT OR INFORMATION CONTAINED HEREIN SHOULD BE REFERRED 
TO ICE HEADQUARTERS TOGETHER WITH A COPY OF THE DOCUMENT. 


Page 851 of 929 




REQUESTED BY : I (b>(G> (b>(7>ic> | 

OFFICIAL USE ONLY 


DEPARTMENT OF HOMELAND SECURITY 
ICE 

REPORT OF INVESTIGATION 
"TITLE: OPERATION FLICKER WISCONSIN LEADS 


TECS ACCESS CODE GT 
PAGE 1 

CASE NUMBER | (b)(7)(E) 


CASE STATUS: INTERIM RPT 


REPORT DATE 

DATE ASSIGNED 


REPORT NO. 

101207 

070607 

PROGRS^L CODE 

008 


RELATED CASE NUMBERS: 


COLLATERAL REQ : 


TYPE OF REPORT: 

INVESTIGATIVE FINDINGS 

I 


TOPIC: WEST VIRIGINA FLICKER LEAD 


SYNOPSIS: 

In April 2006, ICE Cyber Crimes Center initiated an investigation into a 
c r i mi na 1 organizatio n operating a commercial child pornography website known 
as li":agg| . " ICE has designated this PROJECT FLICKER. 


On October 10, 2007, the RAC/Milwaukee advised the RAC/West Virginia that a 
Elkins, West Virginia resident has been identified as a Project Flicker 
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CASE NUMBER 1 

REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: 008 


DETAILS OF INVESTIGATION 


1 . On Ochoher 1 0 

Special Agent [_ 


2007 . 


Senior Special Agent 
RAC/West Virginia. SSA 


Is A [ 


(b)(6) (b)(7 )(C) 
'.buB) (b)(7) I-— r 

1 arl 


t±La±_£AC/Milwaukee received Project Flicker i nformation on 
(bits). (b)(7)(C) ] . The init ial information on I ( b >( 6 >(b)(7)(cT| indicated that 
iB)rf)(b)(7)(C) | , Ashland, Wisconsin. 


J contacted 

dvi S A 1(b)(6) ( b)(7)(C) | 

(b)(B). (b)( 7)(C) | 

(b>(6>, (b>(7)(c> I lived at 


2. The Ashland County Sheriff's Department advised SSA I | that | (b)(6), (b)(7)(C) | 

used to reside at this address when he was attendin g Northl and Col l eae . 

According to the Ashland County Sheriff Department . | moved to |(fr>(s> (b)(7)(C) | 

| ib)(6) (b)(7)(c> | . Elkins, West Virginia in JanuariL_2IHl£__ The sheriff's department 

will contact Northland College to ascertain major. The sheriff's 

department had no in-house records related to | (b)(6), (b)(7>(c> . 


.3 According to Accurint report ran on July 5, 2007, I (b>(6> (b)(7)(C) | 

I (b)(6) (b)(7)(C) I had an address betwe en Januar y 2005 and January 2finfi at I (b)(6) (b)(7)(C) 1 

Avenue, Ashland, Wisconsin. | (b)(6), wcxcTj also had an address at I (b)(6), (b)(7)(C) | 

Avenue, Elkins, West Virginia between Anmiat and June 2007. No Wisconsin 

driver's license number was located for | ww, (b)(7)(C) | . 

4 . PayPal Account information for I (b > (S> <b>(7)(cT| show two accounts . An inactive 

PayPal account | (b)(6), (b)(7)(C) | , which was create d on February 20, 20 05, 

list the Ashland address. The second PayPal account I (b)(6), (b)(7)(C) | , 

which was created December 30, 2006, list the Elkins address. 


4. SSA LZjaLlllI rha e pi art rnn.i cally sent the 

information to SA | (b)(6), (b)(7)(C) | on October 12, 


Project Flicker data, 
2007 . 


the PayPal 
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N U A T I 0 N 
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009 


DETAILS OF INVESTIGATION 


1. On October 26, 2007, SSA I (bxs),(bx7xc) ^ turn over all Project 

Flicker, and Paypal data on two Germantown, Wisconsin residents to Detective 
| (b)(6) (b>(7)(o | , Germantown Police Department. 

2. Project Flicker target I wm), (b)( 7 )(c) | purchased two subscri ptions to 

websites r nni-.ainina child porno graphy in January 2007. 1 ’ I repo rted his 

addres s a s I — . (b)(6),(t>)(7)(C) | . Germantown, Wisconsin. SSA I wt °ra a>(/) | could not 

verify I ww, (b)(7)(c) | name at that address through Accurint . Paypal reports list 
this Germantown address as the billing address. 

3. Project Flicker target I (b)(6), (b)(7)(C) | purchased onp qnhr,rrintinn to a 

website that ronhainpH i-h i l H nnrnnqrapViy in October 2006. | (b)(6), (b)(7)(c>| reported 

his address as I (b)(6), (b)(7)(C) f Germantown, Wisconsin. Accurxnt reports 

verify that | (bxsxwaxc) | resides at this address. « 

4. Detective | (bx6>.(bx7xc> | will brief the district attorney on both individuals 
and anticipates obtaining search warrants for both residences. 
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CASE NUMBER | ( b « 7 « E > | 

REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: 019 


DETAILS OF INVESTIGATION 


1. On November 14, 2008, SSaI (b>(6>(b>(7>(C) | referred five Project 

Flicker targets to Detec tive I < b >< 6 M b >( 7 >< c > [ Green Bay Police 

~ 3 ^r- all Prniprt: Flicker data on I (ww>(c> | 

_ (b«6Mb)(7)(0 | 

to Detective I (b>(6>,(b>(7>(c> fr 

2. Detective | (b>(6>,(b>(7>(c> | stated that 1 (b>(6>.(b>(7>(c> | i s awaiting ; prosecution 

for posse ssion of chi ld pornography by the Brown County District Attorney. 
Detective ! (b)(6). (b)(7)(c) ~] stated that the case was referred to the Brown County 
District Attorney in November 2007 . 
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In April 2006, the ICE Cyber Crimes Center (C-3) initiated an investigation 
into the criminal organiza tion operating a commercial child pornography website 
known as 1°^ ^ . This was a joint DHS-ICE, U.S. Postal Inspection 

Inspection Service, and U.S. Department of Justice Child Exploitation and 
Obscenity Section investigation titled Project Flicker. Project Flicker is an 
ongoing joint investigation targeting the principles facilitating subscription 
payments and the subscribers of commercial child exploitation member restricted 
websites. In September 2007, RAC/Milwaukee received seventy-nine Project 
Flicker targets residing within AOR of RAC/Milwaukee. 

RAC/Milwaukee coordinated with state and local authorities for investigative 
activity ranging from search warrants and/or "Knock-N Talks" interviews on 
sixty-four of the Project Flicker targets. The remaining fifteen Project 
Flicker targets have been disseminated to the Wisconsin Department of Justice- 
Division of Criminal Investigation/ICAC Task Force. Case Closed. 


DISTRIBU TION; 

(b)(7)(E) | 


SIGNATURE: 


SENIOR SPEC AGENT 


SENIOR SPEC AGENT 


ORIGIN OFFICE: MK 
MILWAUKEE, WI - RAC 


J_ 


TELEPHONE: 414 

I (b)(6) (b)(7) 


TYPIST: 
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REPORT OF INVESTIGATION 

CASE NUMBER I < b » 7 >< E > I 


TITLE: COMMERICAL CP WEBSITE KNOWN AS IE, 


CASE STATUS: 

INIT RPT 



REPORT DATE 
081007 

DATE ASSIGNED 
071907 

PROGRAM CODE 

REPORT NO. 
001 

RELATED CASE NUMBERS: 



COLLATERAL REQ 




TYPE OF REPORT: 
OTHER INFORMATION 




TOPIC: CASE OPENING ROI 


SYNOPSIS: 

In April 2006, the Immigration and Customs Enforcement (ICE) , Cyber Crimes 
Center (C3) , Child Exploitation Section (CES) initiated an investigation into 
a rr-im-in al organ i ? at -j on operating a commercial child pornoqraphy website known 
as Iwctims nnKt. I - The investigation has revealed that the same 
organization is operating numerous commercial child pornography websites. In 
addition, the organization utilizes various PayPal accounts to process the 
payments for access to the member-restricted websites. The investigation is 
being worked jointly with ICE/C3/CES, ICE/RAC/ Birmingham, the U.S. Postal 
Inspection Service, the U.S. Department of Justice (DOJ) , Child Exploitation 
and Obscenity Section (CEOS), and the United States Attorney's Office (USAO) 
for the Northern Dis trict of Alabama. ICE has designated this operation as 
PROJECT FLICKER (17711 . This case will serve to manage the leads received by 
ICE RAC/ Beaumont . As leads are substantiated, individual cases will be opened. 

This investigation continues. 


nTSTRTRnTTQNf : 

ATRHlTriPR • 

I (b)(7)(E) | 

| (b)(6) (b)(7)(C) 1 SPECIAL AGENT 



APPROVED- 
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PAGE 


CASE NUMBER 




CASE STATUS: 

CLOSING RPT 




REPORT DATE 
121208 



DATE ASSIGNED 
071907 

PROGRAM. CODE 

H3 

REPORT NO. 
004 

RELATED CASE NUMBERS: 

COLLATERAL REQ: 

TYPE OF REPORT: 
OTHER INFORMATION 




TOPIC: CASE CLOSING ROI 





SYNOPSIS: 

In April 2006, the Immigration and Customs Enforcement (ICE), Cyber Crimes 
Center (C3) , Child Exploitation Section (CES) initiated an investigation into 
a c r j m ^ naj^ organ i zat ion operating a commercial child pornography website known 
as 1 . 11 The investigation has revealed that the same 

organization is operating numerous commercial child pornography websites. In 
addition, the organization utilizes various Pay Pal accounts to process the 
payments for access to the member-restricted websites. 

This report of investigation will serve as a closing report. 



RTGUATIIPR. , 1 

[j (b)(7)(E) | 

| (b)(6) (b)(7)(C) 

^ SENIOR SPEC AGENT 


APPROVE!) • 


| (b)(6) (bM7MC> 

| RAC- RESIDENT AGENT IN 

1 



ORIGIN OFFICE: PU 
BEAUMONT, TX - RAC 

TELEPHONE: 409 83|'“'7c) "1 



TYPIST: lal 


t 11 fj .a: : 
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CASE NUMBER | (b>(7>(E> 

REPORT OF INVESTIGATION 

J 

CONTINUATION 

REPORT NUMBER: 004 


DETAILS OF INVESTIGATION: 


In April 2006, the Immigration and Customs Enforcement (ICE), Cyber Crimes 
Center (C3) , Child Exploitation Section (CES) initiated an investigation into 
a c riminal orqa.nizat ion operating a commercial child pornography website known 
as I . " The investigation has revealed that the same 

organization is operating numerous commercial child pornography websites. In 
addition, the organization utilizes various Pay Pal accounts to process the 
payments for access to the member- restricted websites. 

On 07/18/2007 The Resident Agent in Charge Beaumont received the names and 
addresses of individuals who reside in the Eastern District of Te*as that 
accessed Internet sites, which are alleged to contain child pornography. 

This report of investigation will serve as a closing re port. On Octo ber 16, 

20 08 a Search Warrant was conducted at the_resj_dence of I (b>(B> (b>(7>(c> \ who was 

the reaming i ndividual to be interviewed. I |b>1 ?c ( ) b>(/> | ig the subject of another 
investigation I .t-xs) (b.)(7;<c> | an d will be investigated in connection with that 

case . 

This case is closed pending further information relative to the Eastern 
District of Texas. 
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CASE STATUS: INIT RPT 
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REPORT DATE 
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DATE ASSIGNED 
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CODE 
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001 


RELATED CASE NUMBERS 


COLLATERAL REQ: 


TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 


TOPIC: INITIAL CHECKS ON TARGETS REVEAL CRIMINAL HISTORIES & RELOCATIONS 


SYNOPSIS : 

The RAC/Galveston is currently conducting a collateral investigation into a 


— - - J -- • 1 II i - -m »-• 


(b)(6), (b)(7)(C) 

[ who all appear to be United 


States citizens currently residing in the RAC/Galveston area of 
responsibility. Information provided to SAC/Houston from the ICE Cyber Crime 
Center (C3) indicated that the individuals purchased memberships'' to the 
commercial website to view and download images of child pornography in 
violation of 18 USC 2252. 


This case will manage the RAC Galveston leads. 


nTSTR TROT TON- 
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1 (b)(6) (b)(7)(C) 1 SPECIAL AGENT 
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CASE NUMBER 

(b)(7)(E) 

r 

REPORT OF I 

NVESTIGATION 


CONTI 

N U A T I 0 N 

REPORT NUMBER: 

001 



DETAILS OF INVESTIGATION: 


The RAC/Galveston received a collateral request from SAC/Houston on August 7, 
2007 regarding multiple suspects involved in downloading child pornography 
from the internet in violation of 18 USC 2252. In April 2006, the ICE Cyber 
Crimes Center (C3) initiated an investigation into a cr imi nal orj^aniza t ion 
operating a commercial child pornography website known as 1 ° h " 

The investigation revealed that the same organization was operating numerous 
commercial child pornography websites. In addition, the organization used 
various PayPal accounts to process the payments for access to the 
member-restricted websites. This investigation was worked jointly with 
SAC/Houston, the ICE Cyber Crime Center and the Department of Justice. ICE has 
designated this operation as PROJECT FLICKER. 

Initial checks of TECS, NCIC and LEXIS NEXIS revealed the following 
information: 

| (b)(6), (b)(7)(C) | appears to have no criminal history, lives in Danbury, Texas 

and goes to college in Bryan, Texas. 

| (b)(6). (b)(7)(C) ~| h as already had a knock-n-talk conducted at his 

residence in League City, Texas in regard to child pornography via the 
Internet issues. He consented to a search of his computer and hard drives and 
only child erotica was discovered. Since the information from the UK predates 
the case he was being investigated for by SAC/Houston, no additional 
investigative o r enforcement action will be taken. See Case Number 
I (a)(7)(E) 1 . 

| (b)(6), (b)(7)(C) | appears to have moved to the Pasadena, Texas area. His information 
will be forwarded to that AOR. 


| (b)(6),(b)(7)(c> ~| appears to have a minor criminal history and lives in Alvin, 

Texas . 

| (b)(6), (b)(7)(C) | appears to have a minor criminal history and lives in Dickinson, 

Texas . 

I _ (b)(B>, (b)(7)(C) [ appears to have no criminal history and 

■-1 i in rialupgHnn, Texas. 

| (b)(6), (b)(7)(C) I i s currently under investigation for child pornography as a target 

of Operation Emissary. His computers are currently at the SAC/Houston 
undergoing a vp'H after he signed a Consent to Search form. See 

Report Number | < b >< 7 » E > | . 

| (b)(6), (b)(7)(c) | appears to have no criminal history and lives in League City, 
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Texas . 


I (b)(6), (b)(7)(C) | appears to have no criminal history and lives in Pearland, Texas. 

The investigation continues. 
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TITLE: PROJECT FLICKER -COMMERCIAL CP WEBSITE CALLED I 


CASE STATUS: 
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REPORT DATE 
100808 


DATE ASSIGNED 
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PROC 
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REPORT NO. 
004 









RELATED CASE 

NUMBERS : 






COLLATERAL REQ: 


TYPE OF REPORT: 
OTHER INFORMATION 


TOPIC: CLOSING OF PROJECT FLICKER CASE 


SYNOPSIS: 

This case is being closed until further information/intelligence materializes 
or additional evidence develops regarding the main target (s) due to the local 
disruption caused by Hurricane Ike. It will be reopened in the event that 
relevent information/evidence becomes available. 


This case is closed. 
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(b)(7)(E) 
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CASE STATUS: 
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001 

RELATED CASE 
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COLLATERAL REQ: 


TYPE OF REPORT: 
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TOPIC: CASE BACKGROUND 


SYNOPSIS : 

The Office of the Assistant Special Agent in Charge, Orange County (ASC/OR) , 
is conducting an investigation on numerous people who purchased acc ess to a 
known commercial child pornography website called " L7,7 1° h . Accesses 

to the sites were paid using PayPal accounts. On July 17, 2007, ASC/OR 
received a copy of the PayPal accounts and screen captures of the website. 

All persons suspected of purchasing access to the site are suspected of 
violating Title 18, United States Code, Section 2252 (A) (a) (5) : Possession of 
Child Pornography. 

This case is being opened to document subsequent case openings for this 
operation. 


This ROI documents the history of the operation. 
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DETAILS OF INVESTIGATION 

In April 2006, Immigration and Customs Enforcements cyber Crimes Center, 
Child Exploitation Section initiated an investigation into a criminal 
Qrvranj yaHn n operating a commercial child pornography website known as Li£c_d 
The investigation has revealed that the same organization is 
operating numerous commercial child pornography websites . In addition, the 
organization utilizes various PayPal accounts to process the payments for 
access to the member restricted websites . 

organization offered Individuals monthly 
access to a member restricted website for $79.95 a month. The member 
restricted website solicits customers through an advertising website. The 
member restricted «-*=» fnmmnnl cates with customers via several,> different 


Each one of the undercover purchases followed one of the below listed 
patterns : 

Pattern One: 

The ICE agent accessed a specific advertising website. 

The ICE agent was redirected to an "iWest" payment website and entered 
personally identifiable information, including credit card information. The 
"iWest" payment website identified a specific member restricted website 
through the use of the subject identifiers. 

After completing the required information and clicking submit, the ICE agent 
was redirected to a second web page indicating the payment was currently being 
processed and to check for further information in the e-mail account provided 
by the ICE agent . 

The ICE agent received an e-mail containing payment completion instructions, 
which included a hyperlink to a PayPal account. 

The ICE aqent completed the transaction via the PayPal account. 

The ICE agent received access to the member restricted website from one of the 
administrative e-mails associated with the criminal organization. 

Pattern Two: 
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The ICE agent accessed a specific advertising website. 


The ICE agent was redirected to an "iWest" payment website and entered 
personally identifiable information, including credit card information. The 
"iWest" payment website identified a specific member restricted website 
through the use subject identifiers. 

After completing the required information and clicking submit, the ICE agent 
was redirected to a second web page indicating the payment was currently being 
processed. The web page also contained a button the agent had to click to 
complete the payment. 

The ICE agent clicked the button and was redirected to a secure PayPal payment 
web page. 

The ICE agent completed the transaction via the PayPal account . 

The ICE agent received access to the member restricted website from one of the 
administrative e-mails associated with the criminal organization. 


IDENTIFICATION OF CERTAIN PAYPAL ACCOUNTS 


As indicated above, this criminal organization utilizes multiple PayPal 
accounts to process payments for the monthly subscription fees to the member 
restricted website. PayPal maintains transactional records for each PayPal 
account. The transactional records indicate at least the following items: 
date of purchase, time of purchase, name of customer, subject identifier 
assigned by the owner of the PayPal account indicating what the customer is 
purchasing, amount of purchase, customer's IP address, customer's e-mail 
address, seller's e-mail address, and the Item ID. In addition, PayPal also 
captures the customer's full billing address. 


(b)(7)(E) 


Business Name : 
Proof Soft 
Lencomps LTD 


primary E-Mail Address: 
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Proof Soft 
Belfast LTD 
Belfast LTD 
Financial Services 
Proof Soft 
Bullet Proof Soft 

Bullet Proof Soft (b)(6), (b)(7)(c) 

Bullet Proof Soft 

Bullet Proof Soft 

Lencomps LTD 

N/A 

Jfire Financial 
Al_Sof t_TM 

S Market 


Identification of the subject identifiers and Item IDs used in the PayPal 
accounts 
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OTHER INFORMATION 


TOPIC: CLOSING ROI 


SYNOPSIS : 

The Office of the Assistant Special Agent in Charge, Orange County (ASC/OR) , 
is conducting an investigation on numerous people f* 3 to a 

known commercial child pornography website called " tom: 1 jamam .mar • Accesses 
to the sites were paid using PayPal accounts. On July 17, 2007, ASC/OR 
received a copy of the PayPal acc ounts and screen capt ures of the website. 

One person has been identified as I MgMj>X7j(cj I . r in 1 is suspected of 

purchasing access to the site and is suspected of violating Title 18, United 
States Code, Section 2252 (A) (a) (5) : Possession of Child Pornography. 


This ROI documents the closing of case number 
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The Office of the Assistant Special Agent in Charge, Orange County (ASC/OR) , 
is conducting an investigation on numerous people who purchased acc ess to a 
known commercial child pornography website called 1 ° h ^ 'T.T.J 1 ' • Accesses 

to the sites were paid using PayPal accounts. On July 17, 2007, ASC/OR 
received a copy of the PayPal ^r-onnt-s and s creen captures of the website. 

One person has been identified as I ( b >< B > (b)(7)(C) | i s suspected of 

purchasing access to the site and is suspected of violating Title 18, United 
States Code, Section 2252 (A) (a) (5) : Possession of Child Pornography. 

This case was op ened in error and i s being closed . Tn j ts place S pecial Agent 

| (b>(B) (b>(7xc) \ t opened case number | (b)(7)(E) | for | (b>(6> (b>(7xc> 

Status of Investigation 

This case number is closed, but the inves tigation of 1 (b)(6), (b)(7)(C) | 

continues under case number | wme) | . 
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INVESTIGATIVE FINDINGS 
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TOPIC: REFERRAL TO 

MAINE COMPUTER CRIMES TASK FORCE 



SYNOPSIS: 

April 2006, the Immigration and Customs Enforcement (ICE), Cyber Crimes 
Center (C3) , Child Exploitation Section (CES) initiated an investigation into 
a crimina l organization op erating a commercial child pornography website 
known as U ’." u I . " The investigation has revealed that the same 

organization is operating numerous commercial child pornography websites. In 
addition, the organization utilizes various PayPal accounts to process the 
payments for access to the member restricted websites. The investigation is 
being worked jointly with ICE/C3/CES, ICE/RAC/Birmingham, the U.S. Postal 
Inspection Service, the U.S. Department of Justice (DOJ) , Child Exploitation 
and Obscenity Section (CEOS), and the United States Attorney's Office (USAO) 
for the Northern District of Alabama. 


This ROI will serve as a referral from the RAC/Bangor office to the Maine 
Computer Crimes Task Force; identifying subscriber leads that fall within the 
RAC/Bangor's Area of Responsibility (AOR) . 


DISTRIBUTION: 
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DETAILS OF INVESTIGATION: 

In April 2006, the Immigration and Customs Enforcement (ICE) , Cyber Crimes 
Center (C3) , Child Exploitation Section (CES) initiated an investigation into 
a criminal organization operating a commercial child pornography website 
known as ^ Jua ^ u T?"t " The investigation has revealed that the same 

organization is operating numerous commercial child pornography websites. In 
addition, the organization utilizes various PayPal accounts to process the 
payments for access to the member restricted websites. The investigation is 
being worked jointly with ICE/C3/CES, ICE/RAC/Birmingham, the U.S. Postal 
Inspection Service, the U.S. Department of Justice (DOJ) , Child Exploitation 
and Obscenity Section (CEOS), and the United States Attorney^ Office (USAO) 
for the Northern Dist rict of Alabama. ICE has designated this operation as 
PROJECT FLICKER d t . 


(b)(6), (b)(7)(C>, (b)(7)(E) 


The investigation has identified a group of individuals within the U.S. that 
own and control numerous PayPal accounts. The PayPal accounts are being 
utilized to facilitate the customer payments for the above listed child 
pornography websites. As discussed above, the owners of the PayPal accounts 
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CONTINUATION 
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use specific subject identifiers to indicate which member restricted website 
the customer has purchased access to. Project FLICKER has generated 
approximately 5,000 domestic subscriber leads. 


On April 11, 2007, Project FLICKER was presented to the Attorney Generals 
Advisory Committee for Child Exploitation (AGAC) . The AGAC reviewed and 
approved the project. As such, the domestic subscriber leads are being 
disseminated to each of the ICE SAC offices for any action deemed 
appropriate. It is suggested that each SAC office review the leads to 
determine if any overlap with an existing investigation exists. It is also 
suggested that each ICE office contact the Project Safe Childhood (PSC) 
Coordinator in their respective U.S. Attorney's Office for coordination and 
additional dissemination. Any leads not pursued by the individual SAC/RAC/RA 
should be disseminated to the Internet Crimes Against Children Taskforces 
(ICACs) , or other federal/state/local law enforcement. 


In May of 2007, the RAC/Bangor received a spreadsheet containing subscriber 
leads for subjects located in Maine. The subjects that fall within the 
RAC/Bangor's AOR are as follows: 


(b)(6), (b)(7)(C) 


Hot-h I (b)(6). (b)(7)(C) I and |™| are positive in TECS for 

violations . 


suspected child pornography 


| (b)(6), (b)(7)(C) | has been identified as a subject of investigation of a previous 

R AC/Bangor inv estigation involving suspected possessiQn_Qf__child pornography 
(I (b)(7)(E) | ) . As a result of that investigation, I < b >< 6 > < b >( 7 >(C) | was found to be 

residing within the SAC/NY's AOR and all investigative leads were referred to 
the SAC/NY office. 

j (b)(6), (b)(7)(C) | hag been identified as a subject of investigation of a previous 

RAC/Portland inve stigation involv ing suspected possession of child pornography 
(Operation Falcon I (b)(7)(E) T) . This lead was referred to the Police 

Department by the RAC/Portland office because it was believed that I mio I was 
residing in Wells, Maine at the .t imp Recent information developed under the 
Operation Flicker suggests that I mm 1 was recently residing in Castine, Maine; 
possibly at the Maine Maritime Academy. 


The remaining 3 Maine subjects are negative in TECS. 
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The RAC/Bangor is referring these subjects to the MCCTF for action, a s the y 
deem ap propriate . This matter has been discussed with U.S. Attorney I 1 micn'l 
I (uxbhd,!/; | w hom concurs with this referral. Upon investigation by the MCCTF, if 
it is determined that any of the above cases warrants Federal prosecution, it 
is requested that the MCCTF contact the RAC/Bangor office that will act as a 
conduit for Federal prosecution. 

The investigation is ongoing and, as such, press releases should be 
restricted. If a press release is unavoidable, the press release should be 
coordinated with ICE RAC/Bangor office and U.S. Attorneys Office. In 
addition, the press release should not include any information that identifies 
the national investigation or the identity of the principle PayPal accounts. 
This concern regarding press releases should be passed along to all law 
enforcement /prosecutors working any of the subscriber leads. The 
investigation has targeted at least 14 principles inside the U.S. that are 
controlling the PayPal accounts identified above. Any publicity or media 
release identifying the operation could jeopardize the planned enforcement 
action a against the principles. 

This case is closed. 
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COLLATERAL REQ : 


TYPE OF REPORT; 
INVESTIGATIVE FINDINGS 


TOPIC; INVESTIGATIVE FINDINGS ON OPERATION FLICKER 


SYNOPSIS : 

In April 2006, the Immigration and Customs Enforcement (ICE), Cyber Crimes 
Center (C3) , Child Exploitation Section (CES) initiated an investigation into 
a rr im j organ i za t ion operating a commercial child pornography website known 
as ' Ivi'ams r n «r n^n . " The investigation has revealed that the same 
organization is operating numerous commercial child pornography websites. In 
addition, the organization utilizes various PayPal accounts to process the 
payments for access to the member-restricted websites. The investigation is 
being worked jointly with ICE/C3/CES, ICE/RAC/Birmingham, the U.S. Postal 
Inspection Service, the U.S. Department of Justice (DOJ) , Child Exploitation 
and Obscenity Section (CEOS), and the United States Attorney's Office (USAO) 
for the Northern District of Alabama. ICE has designated this operation as 
Project FLICKER. 


This TECS Record documents the investigative actions taken by ICE in reference 
to Project FLICKER. 


I DISTRIBUTION; 
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Details of Investigation 

In April 2006, the National Center for Missing and Exploited Children (NCMEC) 
nynv^pri information to ICE that the website located at . 

I was a commercial website offering the sale of child 
exploitation images mI^ EC received this information from the NCMEC Cyber-Tip 
Hotline. Special Agents from the U.S. Immigration and Customs Enforcement 
(ICE), Cyber Crimes Center (C3) , Child Exploitation Section (CES) initiated an 
investigation into the cr imi nal , w q rga ni 2 at ion operating a commercial child 
pornography website known as imh^l " The investigation has revealed 

that the same organization is operating numerous child pornography websites. 

In addition, the organization utilizes various PayPal accounts to process the 
payments for access to the member-restricted websites. The investigation is 
being worked jointly with ICE/C3/CES, ICE RAC/Birmingham, U.S. Postal 
Inspection Service, U.S. Department of Justice (DOJ) , Child Exploitation and 
Obscenity Section (CEOS), and the United States Attorney's Office (USAO) for 
the Northern District of Alabama. The investigation has been designated 


Project FLICKER. 





(b)(3): 18 U.S.C. § 3509(d) Child victims’ and child witnesses’ rights. (b)(3): 18 U.S.C. § 3509(d) (Federal Victims' Protection and Rights Act) 
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(b)(3): 18 U.S.C. § 3509(d) Child victims' and child witnesses’ rights, (b)(3): 1 8 U.S.C § 3509(d) (Federal Victims' Protection and Rights Act), (b)(7)(E) 


OFFICIAL USE ONLY 

THIS DOCUMENT IS LOANED TO YOU FOR OFFICIAL USE ONLY AND REMAINS THE PROPERTY 
OF THE DEPARTMENT OF HOMELAND SECURITY, ICE. ANY FURTHER REQUEST FOR 
DISCLOSURE OF THIS DOCUMENT OR INFORMATION CONTAINED HEREIN SHOULD BE REFERRED 
TO ICE HEADQUARTERS TOGETHER WITH A COPY OF THE DOCUMENT. 


Page 891 of 929 








OFFICIAL USE ONLY 


DEPARTMENT OF HOMELAND SECURITY 
ICE 

REPORT OF INVESTIGATI 
CONTINUATION 

The following administrative e-mail addres; . 

distribution of the location and login information for the member restricted 
websites : 
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In April 2006, the Immigration and Customs Enforcement {ICE) , Cyber Crimes 
Center (C3) , Child Exploitation Section (CES) initiated an investigation into 
a criminal Qra^n^zat ion op erating a commercial child pornography website 
known as 1^',^ J . " The investigation has revealed that the same 

organization is operating numerous commercial child pornography websites. In 
addition, the organization utilizes various PayPal accounts to process the 
payments for access to the member- restricted websites. The investigation is 
being worked jointly with ICE/C3/CES, ICE/RAC/Birmingham, the U.S. Postal 
Inspection Service, the U.S. Department of Justice (DOJ) , Child Exploitation 
and Obscenity Section (CEOS), and the United States Attorney's Office (USAO) 
for the Northern District of Alabama. ICE has designated this operation as 
Project FLICKER. 

This ROI documents the closing of Project FLICKER 
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CASE NUMBER | (b)(7)(E) ] 

REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: 006 


Details of investigation 

In April 2006 , the Immigration and Customs Enforcement (ICE) , Cyber Crimes 
Center (C3) , Child Exploitation Section (CES) initiated an investigation into 
a cr imi na 1 praam. za t ion op erating a commercial child pornography website 
known as nXTl " The investigation has revealed that the same 

organization is operating numerous commercial child pornography websites. In 
addition, the organization utilizes various PayPal accounts to process the 
payments for access to the member- restricted websites. The investigation is 
being worked jointly with ICE/C3/CES , ICE/RAC/ Birmingham, the U.S. Postal 
Inspection Service, the U.S. Department of Justice (DOJ) , Child Exploitation 
and Obscenity Section (CEOS), and the United States Attorney's Office (USAO) 
for the Northern District of Alabama. ICE has designated this operation as 
Project FLICKER. 

During the course of investigating Project FLICKER, ICE SAC Atlanta 
successfully prosecuted 2 subjects for Title 18 United States Code 
2252A{a) (2) , the receipt and distribution of child pornography and Title 18 
United States Code 2252(a)(5), the possession of child pornography. Due to 
the evidence from FLICKER becoming stale this case is closed and if new 
evidence is presented regarding FLICKER leads a new case will be opened. 
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RELATED CASE NUMBERS: 


COLLATERAL REQ 


TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 


(TOPIC: TRANSFER OF CASE TO COPENHAGEN, DENMARK 

i _____ 

SYNOPSIS: 


The initial request was received from the Resident Agent in Charge, 
Birmingham, (RAC/BI) and the Cyber Crimes Center which are conducting a joint 
investigation involving numerous persons between several European countries 
and the United States in the distribution of child pornography through the 
internet. The investigation indicates that some of the operators of the child 
porn sites are located in Latvia. 

This matter is being referred to the ICE Attache Copenhagen. 

UNDEVELOPED LEADS 

The ICE Attache Copenhagen is requested to provide assistance in fully 
identifying the operato rs of the child pornography websites regarding Case 
I (b)(7)(E) | . Report findings to the SAC Birmingham. 
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RELATED CASE NUMBERS: 

COLLATERAL REQ: 

TYPE OF REPORT 





INVESTIGATIVE FINDINGS 
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TOPIC: PROJECT FLICKER BACKGROUND INFORMATION AND OPENING REPORT 


SYNOPSIS: 

Ice Cyber Crimes Center (C3), Child Exploitation Section (CES) , provided 
subscriber leads on individuals that had subscribed to child pornography 
websites specific to each SAC office's area of responsibility. In addition to 
the numerous subscriber leads generated, this project named "Operation 
Flicker" has identified and is targeting several principles associated with 
commercial child exploitation websites. 108 of the subscriber leads fall 
under the SAC Baltimore area of responsibility. Each lead will be processed 
and individual cases will be initiated on a case-by-case basis. 
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DETAILS OF INVESTIGATION 

SAC Baltimore has received 108 subscriber leads from C3 on a case called 
"Operation Flicker". These subscribers paid for access to child pornography 
websites through the paypal service. Project Flicker was initiated in April 
2006 based on information received from the National Center for Missing and 

Exploited children (NCMEC) cyber tip line, ncmec disco vered a commercial 

website offering the sale of child pornography images. | (b)(7)(E) 

(b)(7)(E) 


The website is known as iS and is a commercial child 

pornography website. An investigation into this site has revealed that the 
organization operating it is operating numerous other commercial child 
pornography websites. The organization utilizes various paypal accounts to 
process payments for access to the child pornography websites. Some of these 
websites have been identified during other child pornography investigations. 
Ice agents have conducted over 80 undercover transactions on these websites. 

In April 2007, ICE presented Project Flicker to the Attorney Generals Advisory 
Committee on Child Exploitation, who reviewed and approved the project for 
national distribution. Project Flicker has identified approximately 4, 900 
domestic subscribers and 3,300 international subscribers to the child 
pornography websites. Some of these subscribers may appear in other 
commercial child pornography website investigations, so the leads can be 
compared to previous lists that ICE offices may have. 

All 108 leads sent to the SAC Baltimore will be vetted and set in priority 
order by the number of purchases the subject has or by prior criminal history. 

Prior sex offenders being first priority as well as subjects employed by the 
Department of Defense with high-level clearances. 
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In or about May 2007, ICE Cyber Crimes Center (C3) , Child Exploitation Section 
(CES) , sent subscriber leads on individuals that had subscribed to child 
pornography websites specific to each SAC's area of respon sbility ■ This case 
was opened as a general office of investigation case by SA | (b)(15 f > c ( f >(/> [ when the 
leads were first provided. As information developed relevant to a specific 
subscriber, a SAC/Baltimore case was opened under that individual's name and/or 
screen name. There is no need to keep a general case open for these leads. 
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CONTI 
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002 


In or about May 2007, ICE Cyber Crimes Center (C3) , Child Exploitation Section 
(CES) , sent subscriber leads on individuals that had subscribed to child 
pornography websites specific to each SAC's area of responsbi_LLty . This case 
was opened as a general office of investigation case by SA I b m(c> b> l when the 
leads were first provided. As information developed relevant to a specific 
subscriber, a SAC/Baltimore case was opened under that individual's name and/ 
or screen name . There is no need to keep a general case open for the leads 
provided in May 2007. 
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TITLE: ANDREW C. EVANS (PROJECT FLICKER) 

CASE STATUS: 
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RELATED CASE NUMBERS: 


COLLATERAL REQ: 


TYPE OF REPORT: 
INVESTIGATIVE FINDINGS 


TOPIC: INITIAL INFORMATION ON | (b)(6), (b)(7)(C) 


SYNOPSIS: 

In April 2006, Immigration and Customs Enforcement {ICE), Cyber Qrimes Center 
(C3) , Child Exploitation Section (CES) initiated an investigation into a 
cr i mina 1 organi za t io n operating a commercial child pornography website known 
as " ICE has designated this operation as PROJECT FLICKER. 

The investigation has revealed that the same organization is operating 
numerous commercial child pornography websites. It was during the course of 
this in vestigation that ICE C3 identified several names associated with email 
address | (b>(6>,(b>(7>(c> | one of which was an alleged purchaser of child 

pornography via the Internet . 

The following report of investigation documents the investigative activities 
conducted by the Special Agent in Charge, San Francisco (SAC/SF) . 
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I typistT| (b>(6 » b>(7> 
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REPORT OF INVESTIGATION 
CONTINUATION 

De t ails of Investigation! 

In April 2006, Immigration and Customs Enforcement (ICE) , Cyber Crimes Center 
(C3 ) , Child Exploitation Section (CES) initiated an investigation into a 
crim inal or era n i z a t i o n operating a commercial child pornography website known 
as '' Ivrtimv Inn rhiiH .LnTcw 1 . 11 ICE has designated this operation as PROJECT FLICKER. 
The investigation has revealed that the same organization is operating 
numerous commercial child pornography websites. It was during the course of 
this invpfiHnaHnn that. ICE C3 identified several names associated with email 
address I (b)(6), (b)(7)(c) | on e of which was an alleged purchaser of child 

pornography via the Internet. 

On May 18, 2007, an Accurint query was conducted on one of the names 
a.q.qnr i ateri with che known purchase of child pornography via the Internet, 

I (b»6). (b)(7)(C) l xhe following information was obtained: 

Name : 

DOB: 

SSN: 




In addition, on May 18, 2007, the California Law Enforcement 
Telecommunications System (CLETS) and the National Crime Information Center 
(NCIC) databases were queried with the following results: 



As of May 18, 2007, there are no wants on | (b >( 6 > ( b )( 7 >( c ) 


On May 21, 2007, the California Employment nrve.1 nnmenr Henri rtinrint <EDD) was 

contacted regarding the employment of | (b>(6> (b>(7xc> | | ( b >(s> (b)(7)(C) |. EDD had no 

employment history recorded. 


On August 16, 2007, an AutoTrack query was conducted again revealing the 
following i 
Name : 

DOB: 

SSN: 
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On August 22, 2006, a Customs Summons was issued to YahQP I Inc , requesting 

subscriber information relating to email address | (b)(6), (b)(7)(c) j The 

following information was obtained: 


According to the Yahoo! Account Management Tool: 



However, according to Yahoo! subscriber information: 



Furthermore, the following Internet Protocol (IP) informa l- inn was received 
from representatives of Yahoo! relating to email address | (b>(6> ' (b>(7>(C> I s 
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and (b)(6>, (b>(7>(c> are xp addresses belonging to Comcast. 

I (b)(6), (b)(7)(C) I is an IP address that belongs to Surewest. 



Therefore, on September 6, 2007, a Custom Summons was issued to both Comcast 
and Surewest Internet service providers (ISP) requesting subscriber 
information relating to the above IP addresses, dates and times. The 
following information was obtained: 
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On October 2, 2007, an AutoTrack query was conducted on Andrew EVANS based on 
the Yahoo! subscriber information. The following information was obtained: 



■ess: I ' n M A u ' 1 

Antelope, CA 95843 (As of 04/2007) 


A query into the National Law Enforcement Telecommunication System (NLETS) 
found the following information: 

FBI# : 

NAME (s) 

DOB: 

HGT : 

WHT: 

EYE: 

HAI : 

POB: 

CDL : 

SSN: 
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As of October 2, 2007, there are no NCIC wants for I (b)(6), (b)(7)(C) | . 


A1 no . on October 2. 200 7 f an employment request was sent to EDD re garding 
| (b>(6), (b)(7)(c) | . EDD representatives revealed that did not have 

a wage report on file. 

On October 9, 2007, the CA Department of Motor Vehicle (DMV) photo of | (b)(6 ( > c ( ) b)(7 >| 
was obtained with the following information: 


Name : 

CDL : 

Hair: 

Eyes : 

Height : 

Weight : 

DOB: 

Address 

Status : 

On October 10, 2007, an AutoTrack query was conducted on I ww, wwo ~] based on 
the CA driver's license information. The following information was obtained: 


Name : 

SSN: 

Address (es) 


aa — on Qctabac in ?nm an employment request was sent to EDD regarding 

| (b)(6), (b)(7)(C) 1 1 EDD representatives revealed that that social 

security number was not found. 


(b)(6), (b)(7)(C) 


(b)(6), (b)(7)(C) 


On October 11, 2007, a Custom Summons was issued to Ygnition Network Inc. 
regarding the following IP address associated with the alleged purchase of 
child pornography obtained via FLICKER: 

[ (b)(6), (b)(7)(C) | on December 3, 2006, at 1:46 a.m. (PST) 

An additional query was conducted on October 11, 2007 into the NCIC, which 
revealed the following information: 


No NCIC wants 
No NCIC wants 


(b)(6), (b)(7)(C), (b)(7)(E) 
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The SAC/SF investigation continues. 
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RELATED CASE NUMBERS: 

COLLATERAL REQ: 


INVESTIGATIVE FINDINGS 


TOPIC: CLOSING REPORT OF INVESTIGATION 


SYNOPSIS: 


In April 2006, Immigration and Customs Enforcement (ICE), Cyber Crimes Center 
(C3) , Child Exploitation Section (CES) initiated an investigation into a 
c r i mi rial organi z at io n operating a commercial child pornography website known 
as ^?ET 11 ICE has designated this operation as PROJECT FLICKER. 

The investigation has revealed that the same organization is operating 
numerous commercial child pornography websites. It was during the course of 
this in vestigation that ICE C3 identified several names associated with email 
address I _ (DMGxaK/xo | one of which was an alleged purchaser^of child 

pornography via the Internet. 


At the time of this report W as located at the California Department., of 
Corrections and Rehabilitation Deuel Vocational Institution (DVI) . | IC > I is 
expected to be released from incarceration on July 28, 2010. 
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REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: 003 


DETAILS OF INVESTIGATION: 

In April 2006, Immigration and Customs Enforcement (ICE), Cyber Crimes Center 
(C3) , Child Exploitation Section (CES) initiated an investigation into a 
cri minal organizatio n operating a commercial child pornography website known 
as 'GJlESiSSSSSl- “ ICE has designated this operation as PROJECT FLICKER. 
The investigation nas revealed that the same organization is operating 
numerous commercial child pornography websites. It was during the course of 
this in vest iaa t i on that ICR C3 identified several names associated with email 
address I (b)(6), (b)(7)(C) | one Q f which was an alleged purchaser of child 

pornography via the Internet . 

| (b)(6), (b)(7)(C) "*] , the subject of this investigation, was arrested and 

convicted for unrelated theft, burglary, credit card fraud, and controlled 
substance c harges during the course of the ICE investigation. At the time of 
this report was located at the California Dep artment of Corrections and 

Rehabilitation Deuel Vocational Institution (DVI) . P jci is expected to be 
released from incarceration on July 28, 2010. 

Any evidence of child pornography has long been destroyed, tainted or 
considered stale. 

CASE CLOSED 
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COLLATERAL REQ: 


TYPE OF REPORT: 
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TOPIC: SUMMONSES ISSUED TO PAYPAL 


SYNOPSIS : 

This Child Pornography and Exploitation case will serve as the umbrella case 
for the Office of the Resident Agent in Charge, San Francisco International 
Airport (RAC/SI) to incorporate general investigative and enforcement 
activities involving child sexual exploitation, internet and cyber crimes 
against children, leads from other law enforcement entities, locating and 
apprehending aliens with criminal convictions for sexual offenses against 
children, and other crimes involving the sexual abuse of children are examples 
of the types of activities that will be annotated under this case heading. 

This case will include developing and undevelo ped leads from O peration 
Flicker, Opera tion Falcon. Op eration Predator d < b >( 7 >< E > 1 ) , Operation 

Emissary and ( I wmtE) | ) , and Operation Watchdog. This case will remain 
open for Fiscal-Year 2008. 

This report summarizes investigative efforts on Operation Flicker and serves 
as the initial ROI under the Child Pornography and Exploitation umbrella case. 
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DETAILS OF INVESTIGATION 

This Child Pornography and Exploitation case will serve as the umbrella case 
for the Office of the Resident Agent in Charge, San Francisco International 
Airport (RAC/SI) to incorporate general investigative and enforcement 
activities involving child sexual exploitation, internet and cyber crimes 
against children, leads from other law enforcement entities, locating and 
apprehending aliens with criminal convictions for sexual offenses against 
children, and other crimes involving the sexual abuse of children are examples 
of the types of activities that will be annotated under this case heading. 

This case will include developing and undevelo ped leads from O peration 
Flicker, Oper ation Falcon, Op eration Predator ( | (b)(7)(E) ~| ) , Operation 

Emissary and ( I (b)(7)(E) ~|j . and Operation Watchdog . TETs case will remain 

open for Fiscal -Year 2008. 

On December 20, 2007, RAC/SI Agents submitted six (6) U.S. Customs Summons to 
the PayPal Fraud Investigation Team in San Jose, CA. The summonses were 
issued to obtain recent account holder activity for nn^raHnn Flicker tar gets 

pin. San Maten Counts L £1 target s areu I (b)(6), (b)(7> ( c> I 

| (b)(6), (b)(7)(C) and | (b)(6), (b)(7)(C) | . The summons were 

issued on these six (6) based on the number of child porn website 
subscriptions purchased, as provided in the initial Operation Flicker lead 
information, and/or how recent the targets last purchase was made. 

It is anticipated that these summons will yield more recent purchases of 
subscriptions to suspect websites and will assist RAC/SI Agents in securing 
search warrants from the Unites States Attorney's Office and the U.S. District 
Court of Northern California. 

The investigation continues. 
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TOPIC: CASE CLOSED 


SYNOPSIS: 

This Child Pornography and Exploitation case will serve as the umbrella case 
for the Office of the Resident Agent in Charge, San Francisco International 
Airport (RAC/SI) to incorporate general investigative and enforcement 
activities involving child sexual exploitation, internet and cyber crimes 
against children, leads from other law enforcement entities, locating and 
apprehending aliens with criminal convictions for sexual offenses against 
children, and other crimes involving the sexual abuse of children are examples 
of the types of activities that will be annotated under this case heading. 

This case will include developing and undeveloped le ads from Operation Falcon 
( | (b)(7)(E) | ) # Operation Predator ( I waxe) ~| ) , Operation Emissary and 


Emissary II, and Operation Watchdog. 
Year 2008. 


This case will remain open for Fiscal 


This report will serve as the closing ROI for this case. 
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CASE NUMBER | (b)(7)(E) [ 

REPORT OF INVESTIGATION 


CONTINUATION 

REPORT NUMBER: 002 


DETAILS OF INVESTIGATION 

This Child Pornography and Exploitation case will serve as the umbrella case 
for the Office of the Resident Agent in Charge, San Francisco International 
Airport (RAC/SI) to incorporate general investigative and enforcement 
activities involving child sexual exploitation, internet and cyber crimes 
against children, leads from other law enforcement entities, locating and 
apprehending aliens with criminal convictions for sexual offenses against 
children, and other crimes involving the sexual abuse of children are examples 
of the types of activities that will be annotated under this case heading. 

This case will i nclude developing and undeveloped lea ds from Operation Falcon 
( I (b)(7)(E) | ) , Operation Predator ( I ( b >< 7 >< E > I ) , Operation Emissary and 

Emissary II, and Operation Watchdog. This case will remain open for Fiscal 
Year 2008. 

All suspect information, purchase information and undeveloped leads will be 
maintained by the RAC/SI . 

Case closed. 
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Immigration and Customs Enforcement pp.qHpnt- Agent in Charge, Pittsburgh, 

Pennsylvania {ICE RAC PB) CFA SSA | (b)(6), (b)(7>(c> | conducts computer forensic 

examinations for the ICE RAC PB and other law enforcement agencies. This case 
file will track hours and examinations relating to computer forensic 
examinations for FY 2008. 
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Immigration and Customs Enforceme nt , Resident Agent in Charge, Pittsburgh, 
Pennsylvania (ICE RAC PB) CFA SSA | (b)(6) (b)(7)(C) | conducts computer forensic 

examinations for the ICE RAC PB and other law enforcement agencies. This case 
file will track hours and examinations relating to computer forensic 
examinations for FY 2008. 


The RAC Pittsburgh will close this case. 
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